Carving

Carving is (File/data content carving) The process of recovering and reconstructing file content directly from block storage without using the file system metadata. More generally, data(structure) carving is the process of reconstructing logical objects (such as files and database records) from a bulk data capture (disk/RAM image) without using metadata that describes the location and layout of the artifacts. Data carvers use knowledge of the data formats to identify and validate the extracted content.

Definitions

According to the CyBOK (version 1),

Carving. (File/data content carving) The process of recovering and reconstructing file content directly from block storage without using the file system metadata. More generally, data(structure) carving is the process of reconstructing logical objects (such as files and database records) from a bulk data capture (disk/RAM image) without using metadata that describes the location and layout of the artifacts. Data carvers use knowledge of the data formats to identify and validate the extracted content.