How Do File Header Repair and Data Carving Work in Data Recovery?

What Are File Headers and File Signatures?

Every file on a computer begins with a characteristic sequence of bytes - the so-called header or file signature (also known as magic bytes). These few bytes at the beginning of a file tell the operating system and applications what type of file it is, regardless of the file extension.

A JPEG image, for instance, always starts with the bytes FF D8 FF, a PDF document with 25 50 44 46 (which in ASCII corresponds to the text %PDF), and a ZIP file begins with 50 4B 03 04 (ASCII: PK). These signatures are standardized and have remained unchanged for decades.

In addition to the header, many file formats also have a footer - a defined byte sequence at the end of the file. JPEG images end with FF D9, PDF files with %%EOF. Some formats have no explicit footer but define their length within the header itself.

These signatures form the foundation for two related but distinct techniques: file carving and header repair.

How Does File Carving Work?

File carving is a procedure that extracts files without any knowledge of the file system directly from the raw storage device. The name is fitting: files are literally "carved" out of the data stream.

The Basic Process

1. Sector-by-sector scan: The carving tool reads the entire storage device sequentially, typically in 512-byte or 4,096-byte blocks
2. Signature detection: At each position, the tool checks whether a known file signature is present
3. Size determination: The tool determines the file size - either via the footer, through length specifications in the header, or through heuristic methods
4. Extraction: The bytes between the header and the determined file end are extracted as a standalone file
5. Validation: Advanced tools verify the extracted file for integrity

Signature-Based vs. Structure-Based Carving

The simplest form is signature-based carving: it searches for a known header and extracts everything until the next footer or up to a maximum file size. Tools like PhotoRec primarily use this approach.

Structure-based carving goes a step further: it analyzes the internal structure of a file and can thus reconstruct files whose header was found but whose contents are not stored contiguously. Professional forensic tools like X-Ways, Autopsy, or R-Studio use structure-based carving to recover even partially fragmented files.

Important: File carving operates purely at the data level. It requires no functioning file system - neither NTFS, ext4, nor FAT32. This is precisely why it serves as the method of last resort when all file-system-based recovery attempts have failed.

When Is File Carving the Only Option?

File carving is deployed when file system metadata has been irretrievably destroyed. Typical scenarios include:

Complete Formatting

After a complete format, the file system is recreated from scratch. A quick format under Windows (NTFS) merely reinitializes the Master File Table - the actual data initially remains intact. A full format additionally overwrites all sectors, making file carving difficult or impossible.

Destroyed File System

When the file system header (superblock in ext4, boot sector in NTFS) is so severely damaged that no tool can reconstruct the structure, only file carving remains. This occurs, for example, after a head crash on a hard drive, where the read/write heads scrape across the magnetic platters and physically destroy sectors.

Overwritten Partition Table

If the partition table is destroyed by malware, user error, or a ransomware attack, the system loses information about where partitions begin and end. Tools like TestDisk first attempt to reconstruct the partition table. If that fails, file carving is the next step.

Professional data recovery needed?

Request a data recovery quote now.

Request professional data recoveryProf. data recovery needed?0800/073 88 36

Reused or Overwritten Storage Media

On USB sticks, SD cards, and other flash media that have been formatted and rewritten multiple times, file system structures are typically no longer reconstructable. File carving can still find files residing in areas that have not been overwritten.

How Can Header Repair Make Damaged Files Readable Again?

While file carving extracts whole files from the storage device, header repair deals with files that exist but are no longer readable due to a damaged header. This happens more often than one might think:

• Partial overwriting of the file beginning
• Bit errors in the first bytes (bit rot on aging storage media)
• Incomplete write operations after a power failure
• Faulty data recovery software that corrupts the header

JPEG Header Repair

JPEG is the most common format rescued through header repair. Its structure is relatively straightforward:

FF D8 FF E0  - SOI (Start of Image) + APP0 Marker (JFIF)
FF D8 FF E1  - SOI (Start of Image) + APP1 Marker (Exif)

If the first bytes of a JPEG file are damaged but the rest of the file is intact, simply replacing the corrupt bytes with the correct signature is often enough. This can be done manually with a hex editor such as HxD (Windows), Hex Fiend (macOS), or xxd (Linux).

Step by step:

1. Open the file in a hex editor
2. Check the first bytes - if they do not match FF D8 FF E0 or FF D8 FF E1, header damage is present
3. Insert the correct bytes
4. Save the file and test with an image viewer

Caution: If not only the SOI marker but also the subsequent JPEG segments (DQT, DHT, SOF) are damaged, a simple header repair is insufficient. In such cases, a compatible JPEG must serve as a reference to reconstruct the missing segments.

PDF Header Repair

PDF files begin with the signature %PDF-1.x (where x is the version number) and end with %%EOF. The internal structure is based on a Cross-Reference Table (xref) that serves as a table of contents for all objects in the file.

For PDF damage, header repair is more complex:

• Damaged header: Can be fixed by inserting the correct signature
• Missing xref table: Must be reconstructed from the objects contained within the document
• Damaged streams: The actual content (text, images) in PDF objects is often compressed (FlateDecode). If a stream is damaged, the affected content may not be recoverable

Tools like qpdf --check or mutool clean can automatically repair certain PDF structural issues. For more severe cases, professional assistance is necessary.

DOCX/XLSX/PPTX - ZIP-Based Office Formats

Modern Microsoft Office formats are essentially ZIP archives containing XML files and embedded media. This means repairing a DOCX is actually repairing a ZIP archive.

The ZIP signature PK (50 4B 03 04) must be present at the file beginning, and the Central Directory at the file end must be intact. If only the header is damaged, a ZIP repair tool like zip -FF (Linux) or WinRAR (repair function) can restore the structure.

For deeper damage, the ZIP archive can be manually extracted and the contained XML files inspected individually. Often only part of the document is affected, and the rest can be saved.

What Are the Limitations of File Carving?

As powerful as file carving is, there are clear limitations everyone should understand before pinning hopes on a complete recovery.

Fragmentation: The Biggest Challenge

When a file is not stored contiguously but distributed in multiple fragments across the storage device, carving becomes unreliable. Signature-based tools find the header but extract only the first contiguous block - the rest of the file is missing or filled with incorrect data.

On hard drives, fragmentation rates range between 5 and 30 percent depending on usage. On SSDs, logical fragmentation due to wear leveling and the SSD controller is often even higher, although this is irrelevant for normal use.

TRIM and Garbage Collection on SSDs

With solid-state drives, an additional problem arises: the TRIM command instructs the controller to physically erase blocks marked as deleted. After TRIM, these blocks contain only zeros - no amount of carving can find data there.

Encrypted Files and Drives

When a storage device is encrypted with BitLocker (Windows), FileVault (macOS), or LUKS (Linux), the raw data on the medium appears as randomly distributed bytes with no recognizable signatures. File carving fundamentally cannot find files on an encrypted drive.

Compressed and Proprietary Formats

Some file formats store their contents fully compressed, leaving no recognizable internal patterns. Others use proprietary structures without publicly documented signatures. In both cases, carving is limited or impossible.

When Are Professional Tools Better Than DIY Approaches?

Free and Open-Source Tools

For an initial recovery attempt, proven free tools are available:

• PhotoRec: Signature-based carving for over 480 file formats, works independently of the file system. Together with TestDisk, it forms a powerful open-source duo.
• Scalpel: Configurable carving tool that supports user-defined signatures
• Foremost: Originally developed by the U.S. Air Force Office of Special Investigations, robust and reliable

Commercial and Professional Solutions

For more complex cases - fragmented files, damaged file system structures, physical media damage - professional data recovery specialists use:

• X-Ways Forensics: Structure-based carving with intelligent fragmentation detection
• R-Studio: Combination of file-system-based recovery and carving
• UFS Explorer: Supports a wide variety of exotic file systems and RAID configurations
• PC-3000 Data Extractor: Forensic tool combined with hardware controllers for working with physically damaged media

Recommendation: Never run a carving attempt directly on the original storage device. Always create a bit-for-bit image first (using dd, ddrescue, or a commercial imaging tool). This prevents faulty read attempts from worsening the damage - especially with hard drives exhibiting mechanical problems.

What Are the Best Practical Tips for Header Repair?

If you want to repair a damaged file yourself, keep the following principles in mind:

1. Work on a copy: Always work on a duplicate, never the original
2. Identify the signature: Determine the expected header based on the file extension or suspected format
3. Hex comparison: Compare the first bytes of the damaged file with an intact file of the same type
4. Minimal changes: Replace only demonstrably incorrect bytes - every unnecessarily changed byte can cause further damage
5. Validation: Open the repaired file with a program that provides detailed error messages to verify repair success

For photos, specialized repair tools such as Stellar Repair for Photo or JPEG Repair Toolkit exist that automate the process and can also fix damage within internal JPEG segments.

When Should You Consult a Professional Data Recovery Service?

DIY attempts make sense when the file system is intact and only individual files are damaged. In the following situations, however, you should contact a trustworthy data recovery service:

• The storage device makes physical noises (clicking, grinding, beeping)
• The hard drive is no longer detected
• It is an SSD or eMMC device where software access is no longer possible
• The data is business-critical and there is no second chance
• Hundreds or thousands of files need to be carved and validated

Professional labs have cleanroom facilities, hardware tools, and years of experience with firmware repairs and chip-off procedures that go far beyond the capabilities of software-based carving.

Why Is File Carving the Last Line of Defense in Data Recovery?

File carving and header repair are indispensable techniques in the data recovery toolkit. They step in precisely where the file system has failed and conventional recovery methods no longer work. Success rates depend on three factors: the quality of the file signature, the degree of fragmentation, and the physical condition of the storage medium.

For individual damaged photos or documents, a DIY attempt with a hex editor or PhotoRec is quite promising. For more complex scenarios - physical damage, encrypted drives, or business-critical data - the path leads through an experienced data recovery specialist who can deploy the right combination of carving, file system analysis, and hardware repair.

Request a data recovery quote now.