Live discovery grid
Candidates stream into a thumbnail grid while the scan is still running. Filter by type, multi-select with the mouse, and start recovering without waiting for the end.
Recover files the file system forgot.Carvify scans raw disks, volumes and images byte by byte and carves out files by their signatures.
A Windows forensic recovery studio. Pick a drive, partition or disk image, choose the file types you want, and watch candidates appear live with thumbnails, offsets and a hex-level inspector.
Scanning sectors…
From raw bytes to recovered files
Carvify doesn’t depend on the file system’s table of contents. Deleted, formatted or damaged media can still hold the original data, so Carvify reads it directly.
Choose the evidence source
Pick a physical drive, a logical volume (NTFS, FAT32, exFAT) or a disk image such as .dd, .img, .raw or .bin.
Select file types
Tick any of the 14 formats, or scan for everything at once. Optionally include fragmented data for maximum recovery depth.
Deep scan in chunks
The drive is read in 32 MB chunks with a 4 MB overlap, so files that cross a chunk boundary are still found.
Match headers and footers
Each file type has a known start and, where available, end signature. Matches become candidates, marked healthy or fragmented.
Inspect and recover
Preview image thumbnails, check the offset and size, then export selected files or everything discovered to a folder you choose.
| Healthy | Header and footer both found. Marked “100% Healthy (Raw Sector Verified)”. |
|---|---|
| Fragmented | Header found but no footer in range. Carved up to the type’s size limit. |
| Stream carved | Formats with no footer (video, audio, archives) are carved from the header onward. |
Good to know: carving recovers file contents, not original file names or folders. Recovered files are named by ID, type and offset, for example recovered_12_JPG_offset_1A4C00.jpg.
Built for investigators and everyday recovery
A dark, focused workspace that keeps scanning, previewing and exporting on one screen.
Forensic inspector
Select a candidate to see its ID, extension, offset in hex and decimal, size in bytes, status and source medium.
Physical, logical or image
Detects PhysicalDrive0–7 and drive letters A–Z that you can open, or loads a disk image file.
Live activity console
A timestamp-free running log of what the scanner and exporter are doing, plus a progress bar with MB scanned.
Sector-aligned export
Exports read from 512-byte aligned offsets and trim the padding, so raw devices are read the way Windows expects.
Responsive scanning
The scan runs on its own thread, so the interface stays usable. You can stop at any moment and still recover what was already found. Progress is calculated from the device size, even for raw drives.
14 file types, identified by signature
Header bytes shown in hexadecimal. Footers are used where the format defines one.
PhotosDocumentsVideoAudioArchives
Technical details
What Carvify is made of and what it needs to run.
| Platform | Windows (uses the Win32 API for raw device access) |
|---|---|
| Language and UI | Python with PyQt6 |
| Scan chunk / overlap | 32 MB / 4 MB |
| Sources | Physical drives, logical volumes, .dd .img .raw .bin images |
| Thumbnails | JPG, PNG and GIF previews at 96 × 96 px |
| Max carve sizes | From 150 MB for GIF up to 5 GB for MP4, AVI and MKV |
| Privileges | Administrator rights are required for raw drives and volumes. Carvify warns you at launch if they’re missing. |
Tip for best results: save recovered files to a different drive than the one you’re scanning, so you don’t overwrite the data you’re trying to rescue. Use Carvify only on media you own or are authorized to examine.
Asad Ali Akbar Shirazi
Cyber Security Professional
Muhammad Madni
Software Engineering Professional