Carve a Deleted Photo from Unallocated Space
HardDigital Forensics & Incident Response20-30 minA seized thumb-drive image, /evidence/thumbdrive.img, is the only evidence left after a suspect wiped the directory listing. A photo they were sharing was deleted — and whoever deleted it did not stop at unlinking the name: the inode behind it has been wiped, so there is no size, no timestamps and no block list for icat to follow. (fls may still surface the orphaned name — ext4 does not scrub the bytes of a removed directory entry — but istat will show you the record behind it is empty, so that lead goes nowhere.) Deleting a file does not scrub its data, though: the JPEG still sits, whole, in unallocated space, betrayed by its own magic-byte signature (FF D8 FF … FF D9). That is what file carving recovers — a file reassembled from its content signature, not from any filesystem metadata. Carve the deleted photo back out of the image, then read the note its author hid inside it.
- Treat /evidence/thumbdrive.img as read-only evidence — carve from the file, never mount it read-write
- Confirm for yourself that the metadata route is dead: `fls` may still show the orphaned name, but `istat` shows the inode behind it is wiped and `icat` returns nothing
- Recover the deleted JPEG by its signature with a carving tool (foremost or photorec) — not by inode
- Save the recovered photo to /root/case/recovered.jpg
- Read the drop-site the photo carries in its metadata and record it in /root/case/dropsite.txt
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.