How file carving works: finding deleted files at the sector level
When you delete a photo on your Mac and empty the trash, the bytes that make up that photo don't immediately disappear. The filesystem — APFS, HFS+, NTFS — marks the disk sectors containing that photo as "available for reuse." The data is still there until something else overwrites those sectors.
This is the fundamental insight that makes file recovery possible. And the technique for exploiting it — file carving — is the core of what SkyFire Recovery does.
What the filesystem actually stores
A filesystem is a lookup table. It records: "File called photo.jpg, created on date X, lives in sectors 4,200,100 through 4,200,600." When you delete the file, the filesystem removes that entry from the lookup table. The sectors themselves are unchanged.
A standard filesystem-level scan (what Finder's "undo delete" or Time Machine uses) only looks at the lookup table. If the entry is gone, the file is gone as far as the filesystem is concerned.
File carving bypasses the lookup table entirely. It reads every sector on the drive directly and looks for patterns that match known file types.
File signatures: how carving identifies file types
Every file type has a characteristic byte sequence at the start of the file — a "magic number." JPEG files start with FF D8 FF. ZIP files start with 50 4B 03 04. PDF files start with 25 50 44 46 (the ASCII characters "%PDF"). PNG files start with 89 50 4E 47.
SkyFire Recovery's carving engine knows the signatures for hundreds of file types. As it reads each sector, it checks: does this sector start with a known signature? If yes, it begins reconstructing the file from that point forward, using the file format's structure to determine where the file ends.
Three levels of carving
Not all deleted files are equally recoverable, and not all carving approaches are equally thorough. Recovery runs three levels:
Level 1 — Quick Catalog (minutes): Reads the filesystem journal and recently-freed inode table. Finds files deleted in the last few days on macOS and Windows. High success rate for recently deleted files. Low false positive rate.
Level 2 — Standard Sector Scan (30 minutes–2 hours): Full surface read of all sectors. Matches signatures, reconstructs file boundaries using format rules. Handles files deleted months or years ago as long as sectors haven't been overwritten. This is the mode most users should run.
Level 3 — Deep Carve (overnight): Runs Level 2 with additional heuristics for fragmented files — files whose sectors are not contiguous on disk. Fragmentation is rare on modern SSDs (which rebalance continuously) but common on older HDDs that were heavily used. Deep Carve attempts to reassemble non-contiguous fragments using file format validation. Higher false positive rate; always preview before recovering.
What affects whether a file is recoverable
Time is the main factor on HDDs. The longer a drive runs after deletion, the more likely those sectors get overwritten by new data. On a busy MacBook's SSD, APFS's TRIM command actively erases freed blocks in the background — which means deleted files on SSDs have a shorter recovery window than on HDDs.
Drive health matters too. A failing drive with bad sectors may have overwritten data with garbage during error recovery. SkyFire Recovery reads SMART data before every scan and flags sectors that are known-bad or reallocated.
Recovery always shows a condition indicator before you recover: Excellent (full file, no gaps), Good (minor gaps, file likely functional), Partial (significant gaps, may be corrupt), Fragmented (non-contiguous, recovery attempted but not guaranteed). Recovering an Excellent-condition file to a different drive will give you back exactly what you lost.