<<< Carving Example (cont.) | Index | Carving Process in Autopsy >>> |
Scan each unallocated block to see if a file type starts there
When found, scan for a footer for that type.
More complicated carving scenarios possible if a file is fragmented on the file system
In most cases, carving starts and ends with data blocks containing file header and footer.
<<< Carving Example (cont.) | Index | Carving Process in Autopsy >>> |