Carving files, which can be performed manually or through an automated process, permits the recovery of a portion of a corrupted or deleted file. During a computer investigation, examiners may encounter deleted files that cannot be fully recovered. However, enough of the file may still be intact and worth restoring.
For example, if a deleted Microsoft Word document called ”sales report.doc” contains the keywords ”Mr. Smith, Bonus,” but the file cannot be viewed, then it is most likely damaged. Even though not enough of the file is intact to be opened, it may still be possible to carve the useful content. Using specialized software, such as Encase, FTK, WinHex, ProDiscover and several others, it may be possible to locate, restore and even repair damaged or overwritten files.