The technique of recovering files based on content (i.e. header, structure and footer), rather than Operating System records. Data carving is most powerful when Operating System information is missing or destroyed. However, it is not capable of returning file name and folder information as this information is held by the Windows Operating System not stored with the file data.
NAME=Deleted File
A file that has been empited from the Recycle Bin and marked as deleted by the filesystem, but which retains sufficient information held in the filesystem (eg. FAT, XFAT, MFT, HPFS, EXT2/3) to be fully recovered.
NAME=exFAT
exFAT (Extended File Allocation Table), a proprietary file system suited especially for flash drives
NAME=FAT
FAT, or "File Allocation Table", is method of formatting a drive for file storage. It has been superseded by NTFS, but for backward compatibility reasons, remains a common format for digital camera memory cards, and external drives. On FAT formatted drives, the File Allocation Table at the start of the drive contains a record of every file on the drive, including recently delted files. This table tells Microsoft Windows the name of the file and the location of the file on the disk.
NAME=file header search
See "data carving"
NAME=File System
On a computer storage device, there is a system used to arrange the way electronic files are stored. The system in place is refered to as the 'File System' (or 'filesytem'). Often external hard drives and camera cards use Microsofts FAT or XFAT. Most commonly PC hard drives use Microsofts NTFS, Mactintosh HPFS, or Linux EXT2/3.
NAME=GPT
In computer hardware, GUID Partition Table (GPT) is a standard for the layout of the partition table on a physical hard disk.
NAME=JBOD (Disk spanning)
JBOD (Just a Bunch Of Disks) is a term to describe the grouping of odd-sized drives into one larger useful drive. Fore example, a JBOD could combine 3 GB, 15 GB, 5.5 GB, and 12 GB drives into a logical drive at 35.5 GB, which is often more useful than the individual drives separately.
NAME=Lost File
A file that has been deleted which no longer has a File System record, but the content of the file remains on the disk and can be recovered. Lost files are located using a technique refered to as "data carving", by searching for the unique header, structure and footer of the file type.
NAME=MFT
On NTFS formatted drives, a table at the start of the drive called the "Master File Table". This table is like a spreadsheet and contains a record of every file on the drive, including recently deleted files. The MFT record tells Microsoft Windows the name of the file and the location of the file on the disk.
NAME=NTFS
NTFS is the standard file system for recent versions of Windows, including Windows Vista, and Windows 7. NTFS supersedes the FAT file system as the preferred file system for MicrosoftΓÇÖs Windows operating systems. NTFS uses a Master File Table" (MFT) to track the location of files stored on a disk.
NAME=RAW Drive
A drive which does not have a valid partition (usually because the existing parition is corrupt and is no longer recognized by Windows).
NAME=Root
In computer Filesystems, the root directory is the first or top-most folder in a hierarchy. Recovered files will appear in their respective sub-folders under the root folder.