File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. This practice allows searching files or other kinds of objects based on content, rather than on metadata, for example for recovering files and fragments of files when directory entries are corrupt or missing, as may be the case…
Article Link: https://www.andreafortuna.org/dfir/some-thought-about-file-carving/