"In the past, recovery experts could easily retrieve a lost file
because an earlier generation of filesystems simply deleted the
directory entry. The meta information that described the physical
location of the data on the disk was preserved, and tools like The
Coroner's Toolkit (TCT [1]) and The Sleuth Kit (TSK [2]) could
uncover the information necessary for restoring the file. Today,
many filesystems delete the full set of meta information, leaving
the data blocks. Putting these pieces together correctly is called
file carving – forensic experts carve the raw data off the
disk and reconstruct the files from it."
