Klennet Carver settings

File formats to search for

You can choose specific file formats to search for in the left panel. Normally, just leave all of them enabled. If you do not need some specific file type, and you know there are many files of that specific type on the media, turning off scan for these formats may make the analysis faster. However, deselecting one of the formats increases the uncertainity area to analyse, which may cause analysis to actually slow down instead. If you have are recovering a memory card, it will actually be faster if you leave all file types enabled even though you may not need some of them.

Cache policy

Klennet Carver uses two-tiered cache, first caching data in RAM and then optionally on a system temporary drive. The default cache settings are good enough in most cases. For details, look at the cache settings reference.

General settings

Enable autosave

If enabled, Carver will save a checkpoint every once in a while, so if the power goes out, the recovery can be resumed.

Limit number of parallel threads

You can use this to limit CPU usage somewhat. Maximum value allows Klennet Carver to use all available CPU cores. Smaller values leave more CPU available for you, trading off analysis speed. Maximum value corresponds to the maximum number of threads your CPU can run in parallel. This is the same as "Logical processors" count in the Task Manger, Performace tab, CPU section.

Only search unallocated space

If you scan a mounted volume (which has a drive letter) and this option is active, Klennet Carver will query the filesystem driver for a map of clusters which are in use on the media. These clusters are then excluded from the analysis. If you do not have the actual media or if you do not want to mount it, use VHD or VHDX disk image to mount the image of the media. If the filesystem is not damaged and you are looking for deleted files, the cluster map provided by the driver is accurate and scanning only unallocated areas of the media will save time. If the filesystem is damaged (in recovery cases other than deleted file recovery), the cluster map returned by the driver may be inaccurate and this option should be used with caution.

Locality restriction

Locality restriction limits search for the next fragment of a file to a vicinity of the last known fragment of that file. The distance is defined in percentage of the total media size. Restricting locality provides speed improvement up to 100 / (Lback + Lfwd) times. That is, if backward locality is set to 5% and forward to 20% (for a total of 25%), maximum speed up is 4x. Restricting locality is only useful if you are working with a hard drive. On a memory card, I recommend that you have it unrestricted in both directions.

Klennet Carver locality settings

Locality settings; green area is to be scanned.

Locality settings apply to images and videos. Recovery of ZIP files does not honor locality restrictions.

Cluster chain smoothing

This setting is used to correct minor reconstruction errors by smooting small gaps in block order as illustrated on the example below.

Cluster chain smoothing example

Cluster chain smoothing.

In this example, a file consists of two fragments, first fragment containing clusters 1 to 14 and the second one clusters 15 to 32. However, during reconstruction clusters 22 and 23 are errorneously placed into red-shaded position, whilst correct placement is shaded green. During smoothing, Klennet Carver determines that reassigning these two clusters to a green position will produce large contiguous fragment, and if the threshold is set to or above two clusters, the clusters are reassigned. This imporves recovery quality, especially with video files.

Compute hashes

If enabled, Klennet Carver will compute MD5 and SHA256 hashes for each recovered file. The hash values are listed in file properties (next to preview). You can also export a list of hash values for all files to CSV. Use Export hashes button on the result page.

Hash values are only if you are doing the recovery for forensic purposes, or if you want duplicate files removed. Enabling this option will increase recovery time, but not by much.

Remove duplicates (requires hashes)

If several files have identical hash values, meaning the files are fully identical, only one will be kept. This is normally useful when recovering ZIP files or documents, and much less useful with images or videos.

Image settings

These settings apply to all supported image file formats.

Maximum reasonable image size

This controls initial guess for the image size. Get all your existing shots you took with the same camera, and look for a largest one. This will give you maximum actual image size. Then, select the lowest possible setting which is still larger than that maximum actual size.

This setting only affects carving time. The end result should still be the same, but correct setting will cut the run time by a couple of hours for a memory card.

Minimum image megapixel size

This setting only applies to fragmented files. Contiguous files below the megapixel threshold will be recovered. All fragmented files with the resolution below the threshold will be summarily dropped from the results. One case when it is really useful is when your high-megapixel camera stores low-resolution JPEG thumbnails in separate files alongside high resolution images. If you are only going after high-resolution images, set this to about 3 megapixels so that carver does not search for fragmented thumbnails. Doing so will cut the processing time somewhat, sometimes by up to 20%.

Maximum bigfragment gap clusters

Controls maximum gap size for bifragment gap carving. Higher values require more analysis time. Settings below 16 are not effective in most cases. Anything above the default value of 256 is probably counterproductive because of slowness and decreased reliability. Size is measured in multiples of filesystem cluster size.

If you need a forensic recovery, leave this setting at zero.

Video settings

Enable header stealing

If enabled, Klennet Carver will use video file headers (and sometimes frames) found on the media to reconstruct files with missing headers. This only works with memory cards, where all videos are shot with the same camera settings. For more details, refer to video recovery page.

Enable video preview

Only available on Windows 10. Enables video preview and video thumbnails whenever possible. Small number of initial frames of the video file are used to create a thumbnail; if the video is mostly black in the beginning, the thumbnail will also be mostly black.

Minimum MPEG2 and MP4 frames

Any sequence of MPEG2 or MP4 frames smaller than the specified value will be discarded when header stealing is performed. MPEG2 uses more frames than MP4. Recommended settings are therefore 10,000 for MPEG2 and 100 for MP4. If you need to extract something really short, like half a second worth of a video, change the appropriate setting one step lower. However, this often causes drastic increase in unusable output.

ZIP settings

Maximum analysis time, per file

ZIP files can be big, and validating these big files takes a long time. Recovery time for ZIP files is proportional to the size of the file squared (known in programming as O(n2)). Therefore, it is quite easy to encounter a ZIP file which requires impractially long time to process. To prevent this, a cut-off time is imposed, that is, if ZIP file cannot be reconstructed within a given time, the attempt is aborted and the file is considered not recoverable.

This also applies to ZIP-based document files (MS Office DOCX, XLSX, PPTX); these are typically recovered in under a minute.

More settings

There are some more settings which I recommend you avoid and do not actually use. These settings are described on additional settings page.