# Deleted File Recovery

> Master the techniques to recover deleted files. Learn file carving, magic numbers, and unallocated space analysis for digital forensics.

Canonical: https://codelivly.com/rooms/deleted-file-recovery
Last updated: 2026-09-12

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module explores the critical forensic techniques used to recover deleted files from digital storage media. You will learn the mechanics of file deletion across different file systems (NTFS, FAT, ext4), understand the concepts of unallocated space and file slack, and master file carving techniques using magic numbers and headers/footers. From a cybersecurity perspective, mastering deleted file recovery is essential for uncovering concealed evidence, reconstructing attacker timelines, and proving that "deleted" rarely means "destroyed" at the physical disk level.

## Lessons

1. What Is File Carving and Why Does It Matter (30 min)
2. How Deletion Works at the File System Level (30 min)
3. Carving Files with Autopsy & Scalpel (30 min)
4. Guided Lab: Recovering Deleted Files from a Disk Image (30 min)

## Related

- [Learning path: Disk and File System Forensics](https://codelivly.com/learning-paths/disk-and-file-system-forensics)
- [All rooms](https://codelivly.com/rooms)