NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Deleted File Recovery
Master the techniques to recover deleted files. Learn file carving, magic numbers, and unallocated space analysis for digital forensics.
Room tasks
1What Is File Carving and Why Does It Matter
2How Deletion Works at the File System Level
3Carving Files with Autopsy & Scalpel
4Guided Lab: Recovering Deleted Files from a Disk Image
Frequently Asked Questions
How can deleted files be recovered?
Deleting usually removes only the directory entry, so data stays in unallocated space until overwritten. Forensic tools recover it through file system metadata or by carving raw data.
What is file carving?
File carving rebuilds files from raw data by searching for known headers and footers, called magic numbers. It works even when file system metadata is missing or damaged.
What is file slack?
File slack is the unused space between the end of a file and the end of its last cluster, which may hold leftover data. This free Codelivly room covers slack and other recovery sources.