File Carving

File carving recovers files from raw data by recognizing file headers (magic bytes) and footers. It works regardless of the filesystem — even when files are deleted, the filesystem is damaged, or you're working with a memory dump or binary blob. The tools scan for known signatures and extract everything they find.

For a full list of magic bytes, see File Analysis.

Carving Workflow

Carving Tools

binwalk suspicious_file          # scan for embedded files
binwalk -e suspicious_file       # extract all found files
binwalk -Me suspicious_file      # recursive extraction
binwalk -E suspicious_file       # entropy analysis (high = compressed/encrypted)

Analysis Steps

file suspicious.*
binwalk suspicious.*        # list embedded signatures
strings suspicious.* | head -50

binwalk -Me suspicious.*
ls -la _suspicious.*/
find _suspicious.*/ -type f | sort

foremost -v -i suspicious.* -o carved/
find carved/ -type f | sort

find carved/ -type f -exec strings {} \; | grep -i "flag{"
grep -r "flag{" carved/ 2>/dev/null

Disk Image Specifics

Checklist

• file + binwalk first — what's embedded?
• binwalk -Me to extract embedded files recursively
• foremost or scalpel for thorough file carving
• strings disk.raw | grep flag
• Mount and browse if it's a filesystem image
• photorec / testdisk for deleted file recovery
• Check for SQLite databases, ZIP files, hidden directories
• Check file slack space for hidden data

Last updated on Aug 1, 2025