Data carving is the process of looking for data in the evidence that was deleted from the filesystem. This is done by identifying file headers and footers in mainly unallocated clusters. The FTK provides several predefined carvers that you can select when adding evidence to a case. You can also create your own custom carvers to meet your exact needs.
Data carving can be selected in the New Case Wizard or later, using the Additional Analysis feature:
In the Carving Options dialog box, you can select the file types that you want to try to recover and click on OK to go back to Detailed Options to then perform the task.
You can also create your own carvers, informing the header and footers of the files that you would like to recover. To create the carver, perform the following steps:
In the toolbar menu, click on Manage.
Click on the Carvers option
Next, select Manage Custom Carvers.
After the carver is processed, you can find the carved files using the Carved Files filter or through...