Digital Forensic Research Workshop (DFRWS) defined data carving as the process of extracting a collection of data from a larger dataset. Applied to a digital investigation case, file carving is the process of extracting "data" from unallocated filesystem space using the file type inner structure, and not filesystem structure, which means that the extraction process is principally based on file types' headers and trailers.
Basically, all data gathered from a smartphone is always in the form of a file. In the digital world, each file is a block of stored binary digits, and each file type is defined depending on how these digits are stored—the use of extensions in file names is meant to easily and precisely determine the file's generic type. This is not a reliable approach since eyes, and even computers, can be fooled just by renaming the files. This leads us to a more advanced approach based on an analysis of the inner file structure in order to determine...