A method for carving fragmented document and image files

Recovering deleted files play an important role in a digital forensic investigation. When a file is deleted, only pointers that link file's metadata to its content are deleted and metadata entry is marked as deleted. As long as data is not overwritten or wiped, deleted data will remain in unallocated space. One of the methods that can be used to recover these deleted files is file carving. File carving reconstructs files only based on their content unlike traditional data recovery methods that use metadata that points to the content. It is mainly done using headers and footers of file types. One of the primary challenges in file carving is to recover deleted files that were fragmented. When a file is fragmented, carving only based on header and footer will produce corrupted file. So this paper discusses a method for carving fragmented document and image files from a FAT32 formatted USB drive.