How do attackers use file carving?

How file carving works in attacker workflows

Attackers use file carving to reconstruct deleted, fragmented, or partially overwritten data from raw storage when normal file system records are gone or incomplete. That makes it useful for pulling back evidence, credentials, keys, documents, browser artefacts, or other remnants that defenders believed were removed.

In practice, carving is most valuable after a compromise, insider activity, or incident response delay, because it can recover bytes directly from unallocated space, slack space, snapshots, images, and other low-level storage artefacts. The technique does not need intact filenames or directory entries, only recoverable file signatures and enough surrounding structure to rebuild content.

File carving is also relevant to storage hygiene because deletion often changes metadata before it eliminates data. If a disk, image, backup, or VM snapshot still contains old sectors, the carved output can reveal prior activity even when the live system appears clean.

What attackers are usually trying to recover

Attackers rarely carve files for curiosity alone. They usually want one of three things: sensitive content that survived deletion, artefacts that expose how the environment is built, or evidence that can be mined for follow-on access.

That can include exported spreadsheets, configuration files, chat logs, database fragments, shell histories, browser caches, application traces, or secret material embedded in recovered documents. In some cases, the value is not the whole file but a fragment containing a token, password, endpoint, or customer record that can be reused elsewhere.

Recovered fragments can also support operational reconnaissance. Even partial file content may reveal naming conventions, environment layout, service dependencies, or backup habits that help an attacker refine later staging and exfiltration steps.

Why deletion is not the same as disposal

File carving succeeds because deletion usually removes references before it removes the underlying bytes. If storage blocks are not overwritten, the original content can remain recoverable until reused, and fragments can persist even when a file is no longer coherently listed by the file system.

That is why secure erasure matters more than simple deletion when data has security value. Full-disk encryption reduces the usefulness of leftover sectors, while secure wiping, crypto-erase, and validated sanitisation methods reduce the chance that a later carve will reconstruct meaningful content.

For defenders, the key point is that storage media, disk images, backups, and snapshots can all become recovery targets. A system may be operationally decommissioned or “cleaned,” yet still leak recoverable remnants if sanitisation was incomplete.

Risk and Threat Considerations

File carving creates a recovery path that bypasses ordinary file-system deletion controls, so data can remain exposed long after users believe it is gone. That matters most where deleted content may contain secrets, investigation-sensitive evidence, regulated data, or material that can be reused for access or further exploitation.

Failure mechanism: The attacker works from raw storage or an image rather than the live file system, then reconstructs recoverable structures from unallocated blocks, slack space, or residual fragments. If storage was not encrypted or securely erased, the carved output can still expose useful content.

Impact: Sensitive information can persist after deletion, complicating incident containment, increasing disclosure risk, and preserving material an attacker can exploit for follow-on compromise, fraud, or intelligence gathering.

Practitioner Guidance

What to verify: Treat “deleted” as a state change, not a disposal control. Verify whether the storage in scope supports snapshots, block reuse, thin provisioning, imaging, backups, or forensic recovery, because those features often determine whether carving will succeed.

Decision rule: If the data ever held secrets or sensitive records, prefer encryption plus sanitisation over deletion alone. If disposal must be provable, use an approved secure-erasure method for the medium rather than assuming the file system’s delete operation is enough.

What good looks like: Data that should not be recoverable is either encrypted with keys destroyed or erased with a validated method appropriate to the storage type. Incident teams can also explain which artefacts remain recoverable, which were overwritten, and which images or snapshots still require treatment.

Practitioner takeaway: File carving is a reminder that data removal is a lifecycle problem, not just a user action, and the control objective is to make recovery technically unproductive, not merely inconvenient.

Related resources from NHI Mgmt Group

• Guide: MITRE D3FEND Guide
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?