File Carving With PhotoRec: What Comes Back and What Never Will

File Carving With PhotoRec: What Comes Back and What Never Will

Content, very often yes. Filenames, folders, and dates, quite possibly never. Understanding why that split exists is the difference between a recovery that ends well and a client who feels blindsided at handover.

A typical NTFS drive engagement starts the same way: an external disk that Windows suddenly reports as RAW, years of office documents on it, no backup. The client's question is always "can you get my files back?" The honest answer has two halves, and both need saying up front.

Repair the filesystem first, carve last

Carving is the last resort, not the first move. An NTFS volume that won't mount often has an intact Master File Table behind a damaged boot sector or a dirty flag. Filesystem-level repair — ntfsfix on Linux, followed by a read-only mount — brings the whole volume back with names, folders, and timestamps exactly as they were.

When that works, the engagement is over in an hour and the client never learns what carving is.

Work on an image of the drive, not the drive itself, whenever the hardware shows any sign of physical distress. Every read of a degrading disk is a withdrawal from a shrinking account. Spend those reads once, into an image file, and run every recovery attempt against the copy.

How signature carving works

Picture a book with its title page torn out. You can still recognize the content from the writing style and each chapter's opening lines. That's close to what PhotoRec does with files.

When the filesystem is truly gone, PhotoRec ignores it entirely, scanning the raw sectors for signatures — the magic bytes that begin known file formats. A ZIP container (which is what a .docx or .xlsx really is) starts with PK; a JPEG starts with FF D8; a PDF with %PDF. When a signature appears, PhotoRec reads forward until the format's end marker or until the data stops making sense. Then it writes the result out as a recovered file.

This is why carving works at all when nothing else does: file content lives in data clusters. Those clusters are usually untouched even when the structures that named and organized them are destroyed.

What never comes back

Filenames, directory structure, and timestamps do not live inside the file content — on NTFS they live in the MFT. When the MFT is gone, that metadata is gone with it, and no carving tool can reconstruct it, because the information physically no longer exists.

What you get instead is PhotoRec's output naming scheme: f0030136.docx, f0030194.xlsx, thousands of them, in flat numbered directories.

On the engagement this framing comes from, roughly 1,600 office documents came back intact and readable. Every one of them nameless. That is a successful carve. It is also, to a client expecting their folder tree, a shock — which is why the conversation about it happens before the work, not after.

Triaging thousands of nameless files

A pile of f*.docx files is not a deliverable; the triage is where the service earns its fee.

1. Sort by type and size first. Extensions are reliable — PhotoRec assigned them from the signatures. Tiny files are usually templates and fragments; the client's real work concentrates in the middle of the size distribution.
2. Mine the internal metadata. Office formats carry author, title, and creation date inside the ZIP container, and those survive carving. A script can read docProps/core.xml from each document. Renaming the file from its embedded title and date rescues a surprising share of the collection.
3. Full-text index the rest. For files with no useful metadata, indexing the extracted text lets the client search by what they remember — a project name, a client, an address. That beats scrolling thumbnails.

Where carving struggles: fragmentation

Carving assumes a file's clusters are contiguous. A fragmented file has its beginning in one place and its continuation somewhere else. This is common for large, long-lived documents and mailbox files on a drive that ran near capacity. PhotoRec reads straight across the gap into unrelated data.

The result is a file that opens but turns to garbage partway through, or does not open at all. Small files fragment rarely, which is why office documents carve well and multi-gigabyte PST archives and videos carve badly.

Setting expectations

Before starting any carving engagement, the client hears the same summary. Content is likely recoverable, names and folders are not, fragmented large files may be partial, and the deliverable includes triage, not just a dump.

Agreeing on that up front turns "you lost my filenames" into "you told me this would happen, and the search index covers it." In recovery work, the technical outcome is fixed by physics — the client experience is fixed by the briefing.

The takeaway

Try filesystem repair first; carve only when the structures are truly gone. Carving trades metadata for content: what a file was called is lost, what it contained usually is not. Plan the triage as part of the job, and brief the client before the first sector is read. Do that, and a nameless pile of 1,600 documents becomes a searchable archive instead of a disappointment.