File Carving Demo
Upload any file to simulate file carving - the forensic technique of recovering files by scanning for known headers (magic bytes) and footers (trailer signatures). The tool searches for 13 common file formats including JPEG, PNG, GIF, BMP, PDF, ZIP, RAR, GZIP, ELF, MP3, RIFF, OLE2, and SQLite. Results show each carved fragment with exact byte offset, estimated size, confidence score, hex preview, and a visual file layout map. This is an educational tool demonstrating basic header/footer carving - all processing runs locally in your browser, no server uploads, no signup required.
Upload any file (disk image, combined file, or raw binary) to simulate file carving - the process of recovering files by scanning for known headers and footers. The tool searches for 13 file signatures including JPEG, PNG, GIF, BMP, PDF, ZIP, RAR, GZIP, ELF, MP3, RIFF, OLE2, and SQLite. Results show each carved fragment with offset, size, confidence score, and hex preview. All processing runs locally in your browser - nothing is uploaded.
Why Use Our File Carving Demo?
Understanding how file carving works is essential for digital forensics, data recovery, and reverse engineering. Our interactive demo makes the process visual and accessible.
13 File Signatures Supported
Scans for JPEG, PNG, GIF, BMP, PDF, ZIP, RAR, GZIP, ELF, MP3, RIFF, OLE2, and SQLite file headers. Each signature includes both header (magic bytes) and footer (trailer) patterns for accurate carving.
Visual File Layout Map
See the spatial arrangement of every carved fragment with an interactive SVG file map. Color-coded bars show where each file type was found, with opacity indicating whether the fragment has a matching footer.
Educational Step-by-Step Output
Every fragment shows header offset, estimated size, confidence score, hex preview, signature bytes, and footer match status. Expand any fragment for detailed educational explanations of the carving process.
100% Private Browser Processing
All file scanning happens entirely in your browser. Your data never leaves your device - no server uploads, no file size limits, and no signup required. Works offline after initial page load.
Common Use Cases for File Carving
From digital forensics to data recovery - file carving is an essential technique across cybersecurity, data recovery, and reverse engineering domains.
Digital Forensics Investigation
Analyze disk images and memory dumps for embedded files. File carving is a fundamental forensic technique used by law enforcement and incident response teams to recover evidence from unallocated space.
Data Recovery from Corrupted Media
Recover files from damaged storage media where the file system is no longer readable. Carving bypasses the file system entirely by searching for file signatures in the raw binary data.
Malware Analysis & Reverse Engineering
Extract embedded executables and payloads from suspicious files. Malware often hides inside other file formats - carving reveals hidden ELF binaries, ZIP archives, and other code.
Educational Forensics Training
Learn how file carving works through hands-on experimentation. Upload test files, concatenated data, or disk images to see exactly how carving algorithms identify and extract embedded content.
File Structure Understanding
Explore how different file formats are structured by seeing their headers and footers in context. The tool reveals the binary signatures that define file boundaries and make carving possible.
Research & Academic Study
Compare carving results across different file types and sizes. Understand the relationship between file signatures, fragment confidence, and the challenges of recovering fragmented or incomplete data.
Understanding File Carving
Everything you need to know about how file carving recovers data from raw binary streams.
What Is File Carving?
File carving is a data recovery technique that extracts files from raw binary data without using file system metadata. Instead of reading directory entries or allocation tables, carving algorithms scan byte-by-byte searching for known file signatures - unique sequences of bytes called magic bytes that identify the start (header) and end (footer) of common file formats. This makes carving essential for recovering data from corrupted drives, forensic disk images, and unallocated space.
How Our File Carving Demo Works
When you upload a file, the tool reads every byte and searches for 13 known file signatures at each offset. When a header match is found, it records the position and searches forward for the corresponding footer. The result is a list of "carved" fragments, each with: the file type identified, the exact byte offset of the header, the estimated size (between header and footer or to the end of the file), a confidence score based on whether the footer was matched, and a hex preview of the header bytes. A visual file map shows the spatial layout of all fragments within the original data.
Understanding Fragment Confidence
Fragments with both a header and footer match get confidence scores above 70%, indicating a high likelihood of a complete, recoverable file. Fragments with only a header match score below 50% - these are partial fragments where the footer was not found, meaning the data may be incomplete or the file extends beyond the scanned region. The confidence also considers fragment size relative to total file size, as larger complete fragments are more reliable indicators of successful recovery.
Privacy & Technical Notes
All file carving runs entirely in your browser using JavaScript. Your uploaded data never leaves your device - there are no server uploads. The practical file size limit is your browser's available memory (typically 1-4 GB). For very large disk images, consider using a dedicated forensic tool like Foremost, Scalpel, or Photorec. The carving demo supports 13 common file signatures; production forensic tools support 100+ signatures with advanced fragmentation handling.
Related Tools
Steganography Detector
Upload an image to detect potential hidden data using LSB (Least Significant Bit) steganography analysis. Analyzes pixel-level modifications, shows a heatmap of altered pixels, detects statistical anomalies, and extracts hidden text messages if found. Compatible with standard LSB encoding and the STEG magic header format. All processing happens locally in your browser - free online steganography detector, no signup required.
Image File Size Analyzer
Upload any image to see a detailed binary-level breakdown of what contributes to its file size - pixel data, compression overhead, metadata (EXIF/IPTC/XMP), color profiles (ICC), and structural headers. Get prioritized optimization tips with estimated savings for web performance, mobile app optimization, and storage reduction. Supports JPEG, PNG, GIF, WebP, BMP, TIFF, AVIF, and HEIC - all processing runs locally in your browser, no server upload required. Free online image file size analyzer.
File Magic Byte Detector
Upload any file to instantly detect its true file type by reading the magic bytes (file signature / header). The tool bypasses incorrect file extensions and reveals the real format. Shows hex dump with matching signature bytes highlighted, ASCII interpretation, MIME type, file category, and extension match analysis. Supports over 120 file signatures across 16 categories: images, audio, video, documents, archives, executables, fonts, certificates, disk images, and more. All processing runs locally in your browser - free online File Magic Byte Detector, no signup required.
Image Clone Detector
Detect copy-move forgeries in images using pixel-block matching. Upload any image to find cloned/copied regions, view heatmap overlays showing the location and intensity of detected clones, and get confidence scores with region details. Three sensitivity presets for different detection needs. 100% private browser-based processing - free online Image Clone Detector.
Frequently Asked Questions About File Carving
Everything you need to know about the File Carving Demo and how file carving works.
File carving is the process of extracting files from raw binary data without using file system metadata. Unlike normal file access which relies on directory structures and allocation tables, carving reads every byte searching for known file signatures (magic bytes). It is a fundamental technique in digital forensics for recovering files from corrupted disks, unallocated space, and forensic disk images.
The tool scans the uploaded file byte-by-byte, checking each position against 13 known file header signatures. When a header match is found (e.g., FF D8 FF for JPEG), it records the offset and searches forward for the corresponding footer (e.g., FF D9 for JPEG). Each fragment is assigned a confidence score based on whether both header and footer were found, and a visual file map shows the spatial arrangement of all detected fragments.
The demo supports 13 common file signatures: JPEG (FF D8 FF), PNG (89 50 4E 47), GIF (47 49 46 38), BMP (42 4D), PDF (25 50 44 46), ZIP (50 4B 03 04), RAR (52 61 72 21), GZIP (1F 8B), ELF (7F 45 4C 46), MP3/ID3 (49 44 33), RIFF/WAV/AVI (52 49 46 46), OLE2 Office documents (D0 CF 11 E0), and SQLite databases (53 51 4C 69 74 65).
Absolutely. All file scanning and carving happens entirely in your browser using JavaScript. Your uploaded file never leaves your device - no data is sent to any server. This makes the tool safe for sensitive forensic data and personal files. The tool also works offline after the initial page load.
Confidence is a score from 0-100 that indicates how likely a fragment represents a complete, recoverable file. Fragments with both a header and footer match score above 70% (green). Fragments with only a header match score below 50% (amber), meaning the data may be incomplete. Confidence also considers relative fragment size - larger complete fragments score higher.
The demo demonstrates basic header/footer carving for non-fragmented files. It does not handle fragmentation - where a file's data is split across multiple non-contiguous regions. Production forensic tools like Foremost, Scalpel, and Photorec use advanced algorithms including Bifragment Gap Carving (BGC) and fragmentation point detection to handle fragmented files.
There is no artificial file size limit. The practical limit is your browser's available memory since the entire file is loaded into memory for scanning. For typical files and disk images up to a few hundred MB, the tool works without issues. For very large images (multiple GB), consider using dedicated forensic tools.
Yes - 100% free, forever. No signup, no account, no premium tier, no usage limits. Run as many file carving scans as you need on any file type.