During which phase of an investigation would a data carving utility typically be used?

During the examination phase of an investigation, a data carving utility is utilized to recover files and data that have been deleted or are otherwise inaccessible due to file system corruption. This process involves analyzing the raw data on storage devices, looking specifically for file signatures or patterns that indicate the presence of certain types of files.

Data carving is essential during the examination phase because it allows investigators to extract information that is not readily visible through standard file system browsing. At this stage, forensic experts systematically analyze the data in detail to find relevant evidence, making it a critical part of understanding the scope and details of the investigation.

While acquisition involves obtaining the digital evidence, and identification/assessment focuses on recognizing and evaluating potential sources of evidence, the analysis phase would typically involve interpreting the data and findings that have been uncovered. Therefore, the examination phase is where the application of data carving tools is most relevant and crucial for revealing hidden or deleted information.