File carving: how recovery works once the filesystem is gone, and why your files come back nameless

Someone formats the wrong drive, or a card comes back from a camera reporting itself as empty. The filesystem, the thing that knew where every file started and what it was called, is gone. And yet the photographs come back. Not all of them, not with their names, but they come back.

The technique that does it is called carving, and understanding what it reads explains both why it works and everything it cannot give you.

What a carver actually reads

Nothing about the filesystem. That is the whole point.

The documentation for foremost, one of the long-standing tools of the genre, describes it as a forensic program to recover lost files based on their headers, footers, and internal data structures, and adds that the headers and footers can be specified by a configuration file, or you can use command line switches to specify built-in file types.

Read that list again: headers, footers, internal structures. Not directories, not a partition table, not an allocation map. A carver walks the raw surface of the disk from one end to the other, and every time it recognises the few bytes that mark the start of a known file type, it starts writing out everything that follows until it recognises the end.

A JPEG begins with a specific signature and closes with another. So does a PDF, a ZIP, a MOV. Those patterns are inside the file itself, which is why they survive the destruction of everything around them.

Why formatting does not stop it

The PhotoRec manual states the consequence directly: PhotoRec ignores the filesystem and goes after the underlying data, so it will work even if your media's filesystem is severely damaged or formatted.

That surprises people, and it should not. A quick format mostly rewrites the bookkeeping. It declares the shelves empty. The books are still on them until something else is put in their place, which is why the single most useful thing you can do after a mistake is stop using the drive immediately.

The names are gone, and they were never in the file

This is the part that disappoints people, and it follows logically from the mechanism.

The PhotoRec documentation lists what disappears when a file is deleted: the meta-information about this file (file name, date/time, size, location of the first data block/cluster, etc.) is lost.

Every item on that list lives in the filesystem. The name of your photograph was never written inside the photograph; it was an entry in a table that pointed at it. Carving skips that table by design, so it can tell you with certainty that these bytes are a valid JPEG, and nothing at all about what you used to call it or which folder it sat in.

That is why a carved recovery arrives as a flat pile of f0012345.jpg, sorted by type rather than by meaning. The content is intact. The organisation is not, and no tool can invent it back, because the information no longer exists anywhere on the disk.

Fragmentation is the real limit

Carving assumes a file lies in one continuous run, header first, footer last. When the filesystem had scattered it across the disk, that assumption breaks and the carver may close the file at the wrong point, giving you a photograph that decodes halfway and then turns to noise.

Tools do fight back. The PhotoRec documentation describes its approach: when a file is recovered successfully, PhotoRec checks the previous data blocks to see if a file signature was found but the file wasn't able to be successfully recovered (that is, the file was too small), and it tries again. This way, some fragmented files can be successfully recovered.

The honest word in that sentence is some. Fragmentation is where carving degrades from reliable to partial, and it is the reason two recoveries from apparently similar disks can produce very different results.

The rule that decides whether any of it is possible

One operational point outweighs every tool choice, and the PhotoRec documentation states it as an instruction rather than a suggestion: you must not choose to write the recovered files to the same partition they were stored on.

The reason is mechanical. The space holding your lost files is, as far as the operating system is concerned, free. Anything you write can be placed there. Recovering onto the source disk means the act of saving each rescued file may overwrite the next one you had not reached yet.

So: recover to a different disk, every time. And if the drive is behaving strangely, image it first and carve the image, because a full-surface scan on a failing drive is a long read across every sector, which is exactly the workload a dying disk handles worst.

When carving is the wrong answer

If the partition still mounts and you can browse the folder tree, you do not want carving. A conventional undelete works from the filesystem metadata and can therefore give you back names, dates and directory structure, which carving structurally cannot. Reach for carving when that layer is gone, unreadable, or lying to you.

And if the drive clicks, disappears mid-copy, or reports growing error counts, the priority is not recovery at all. It is imaging, once, carefully, and carving the copy afterwards.

The short version

Carving reads the disk surface and recognises files by how they begin and end, ignoring the filesystem completely. That is why it survives a format, and why it returns content without names: the name lived in the layer it skips.

Its two limits are fragmentation, where files stored in pieces come back broken, and the destination rule, which is not negotiable. Write your recovery somewhere else, and when the hardware is unwell, carve an image rather than the patient.

The description of carving by headers, footers and internal data structures, and the configuration-file option, are taken from the foremost documentation. The statement that the filesystem is ignored and that recovery works on severely damaged or formatted media, the list of lost meta-information including the file name, the behaviour on fragmented files and the instruction not to write recovered files to the source partition are taken from the PhotoRec documentation. All were checked at the time of writing. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.

Related guides

• Recovering files after a format - the situation carving is most often used for, start to finish.
• Windows File Recovery - Microsoft's own tool, which offers a signature mode built on the same principle.