22. Carving Process in Autopsy

• Autopsy includes PhotoRec - Open source carving tool.

• It runs on unallocated space.

• Carved files are added into a special $CarvedFiles folder.

  • NOTE: This is technically not done when the data source is added. Carving is done with the ingest modules.