File Carving: Recover Data From Hard Drive, USB and CD-ROM
When you erase a file on your computer, it doesn’t just disappear. The directory table is updated saying that the space used by the file is now able to be overwritten. But the file is still intact. Data recovery programs exist to “un-erase” these files. Now, what if your hard drive is damaged, the directory table is corrupt or you need to get data off of a CD-ROM, USB or iPhone?
What if you could recover data from a drive without using the directory table at all? What if you could search a storage media looking for picture files that are hidden or missing? Well, now you can. CGSecurity has created a program called Photorec.
When files are stored on a drive, they are stored in a particular pattern. Picture files have start of image bits and end of image bits. If a program finds these patterns and reads the data in between, the picture will be recovered. Photorec has the ability to recover most common file types including text files, movie files, audio files, and Outlook data files. Some people have even used this utility to recover Iphone data.
It works very well, I ran it on my laptop and it found thousands of deleted items, which I could easily view. Read all about it at CGSecurity.