Question
What is the significance of the numbers in a carved file's name?
Answer
A carved file, by definition, is a file that is not recorded in the file system records but can be found within another data stream. Carved files do not have names or metadata, so FTK assigns its own names.
FTK assigns names like "Carved[xxxxx].jpg".
The number within the brackets is the byte decimal offset count from the first byte of the parent file from which the file was carved.
Examples:
File name: Carved[12345].jpg
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[unallocated space]/006350>>Carved[12345].jpg
Interpretation: The carved file was found beginning at decimal byte offset 12345 within the unallocated chunk "006350".
File name: Carved[789].bmp
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[root]/Documents/MyFile.doc>>Carved[789].bmp
Interpretation: The carved file was found beginning at decimal byte offset 789 within "MyFile.doc".