File Carving

File carving recovers files from raw data by recognizing file headers (magic bytes) and footers. It works regardless of the filesystem, even when files are deleted, the filesystem is damaged, or you're working with a memory dump or binary blob. The tools scan for known signatures and extract everything they find.

For a full list of magic bytes, see File Analysis.

Carving Workflow

Carving Tools

binwalk suspicious_file          # scan for embedded files
binwalk -e suspicious_file       # extract all found files
binwalk -Me suspicious_file      # recursive extraction
binwalk -E suspicious_file       # entropy analysis (high = compressed/encrypted)

Analysis Steps

file suspicious.*
binwalk suspicious.*        # list embedded signatures
strings suspicious.* | head -50

binwalk -Me suspicious.*
ls -la _suspicious.*/
find _suspicious.*/ -type f | sort

foremost -v -i suspicious.* -o carved/
find carved/ -type f | sort

find carved/ -type f -exec strings {} \; | grep -i "flag{"
grep -r "flag{" carved/ 2>/dev/null

Disk Image Specifics

Checklist

• file + binwalk first, to see what's embedded
• binwalk -Me to extract embedded files recursively
• foremost or scalpel for thorough file carving
• strings disk.raw | grep flag
• Mount and browse if it's a filesystem image
• photorec / testdisk for deleted file recovery
• Check for SQLite databases, ZIP files, hidden directories
• Check file slack space for hidden data

Last updated on Aug 1, 2025