SmartCarving - The Key to Recovering More Photos

Recover More Photos with SmarCarving Technology

This article describes SmartCarving, a new recovery technique that improves the recovery rate of deleted files by actually analyzing the contents of each file. This greatly improves on the signature based techniques used in current recovery products, as they are unable to handle files that have been fragmented or corrupted.

In addition, SmartCarving techniques allow for the validation of deleted files, therefore, greatly improving the ability to determine which files are complete and which files are partial or broken. What does this all mean? It basically translates to 15-20% more files recovered on average when compared to existing photo recovery products.

How Does Traditional Photo Recovery Software Work?

Recovery of deleted photo or image files is accomplished by a technique called file or data carving. Traditional data carving, attempts to find the unique header associated with a photo or image file type (for example - "FFD8" for jpegs) and then assumes that the remaining parts of the file are stored consecutively on the disk.

Unfortunately, there is no guarantee that a photo or image file is sequentially stored on a disk. This is because, the file storage may be fragmented (1 or more pieces of the file are stored in different areas of the disk), or worse, part of the file may have been over-written by another file.

This means that most recovery tools show corrupted or garbage images when showing a recovered deleted photo or image file. A common misconception is that since the image is not seen the rest of the data is not present. However, the rest of the data may be present, but since most recovery tools are unable to handle fragmented data the user is never aware if the file can be recovered or not. That is until the discovery of SmartCarving technology.

SmartCarving Technology Breakthrough

Lately there is a new carving technique called SmartCarving which recovers files not based on their starting signatures, but based on the actual contents of files. SmartCarving analyzes files block by block determining if and where files are fragmented, and by looking at the actual content of the data determines where the next pieces of the file are. In essence, SmartCarving attempts to solve the digital equivalent of mixing hundreds of jigsaw puzzles together and reconstructing each one.

As each disk block is analyzed it is compared against that of the previous block to determine how good a fit it is. For photos this involves looking at the boundaries formed when adding a new block and determining the likelihood that the block belongs to the photo. In other words, not only is the structure of the photo used to recover, but individual photo contents are used. This is in fact very similar to how a human would recognize a corrupted photo. Research has shown that on average up to 15-20% more photos can recovered by SmartCarving technology compared to any other technique.

While all this sounds interesting what is the science behind it and does it really work? SmartCarving was researched and presented as a paper to the Digital Forensics Research Workshop (DRFWS) in 2008. It won the best paper of the conference award, and therefore, has the recognition of the foremost forensic scientists in the world.

Another product called Adroit Photo Recovery incorporates SmartCarving for jpegs. While currently only photos are supported, future products will support SmartCarving of additional file types. Adroit Photo Recovery is free to try and can easily be downloaded from Internet.