:Undeleted: Carving Tools Help You Recover Deleted Files
Undeleted: Carving Tools Help You Recover Deleted Files Jul 24, 2008, 19 :05 UTC (0 Talkback[s]) (6814 reads) (Other stories by Ralph Spenneberg)
"In the past, recovery experts could easily retrieve a lost file because an earlier generation of filesystems simply deleted the directory entry. The meta information that described the physical location of the data on the disk was preserved, and tools like The Coroner’s Toolkit (TCT [1]) and The Sleuth Kit (TSK [2]) could uncover the information necessary for restoring the file. Today, many filesystems delete the full set of meta information, leaving the data blocks. Putting these pieces together correctly is called file carving – forensic experts carve the raw data off the disk and reconstruct the files from it."
