Carving is a common technique to recover deleted files. It usually requires a lot of disk space. Now an inproved technique, called in-place, in-line or zero space carving, is going to change that - and it also noticeable speeds up processing.
The whole process of carving is based upon the assumption that files start with a typic sequence of characters. For example Adobe's Portable Document Format (PDF) requires a starting sequence of "%PDF", while Phil Katz, the author of the ZIP archive format, chosed his initials "PK" to become the signature. Similarly another sequence of characters could indicate the end of a file. Alternatively the file size may be known from a header or estimated.
In this way files can be reconstructed from a disk image. The method "carves" all characters between the start and end sequences and copies them into a new file. If the original storage media was completely filled and all files are found by the carver then the process requires almost the same amount of free disk space to hold the carved files, not to forget the time consumed to copy that amount of data.
In-place carving addresss both problems. Instead of copying the data, an in-place carver just logs the start and end positions. It may also keep track of which sectors already have been assigned to a file. Obviously this procedure requires significantly less disk space. Access to reconstructed files could then be provided on demand through a virtual file system (VFS).
Both procedures spend a significant amount of time doing string comparisons to detect start and end signatures. However building the index should consume less time than transfering the carved file. The VFS induces some overhead. This effect is expected to be small for a single or a few triage runs. If you decide to examine a file thoroughly you still could create a working copy.
