[AnIdiotOnTheNet]

If anyone would like to read more, this technique is called "file carving".

> That will work if your file isn't fragmented on the disk, I guess.

Even 15 years ago when I was doing digital forensics it was actually pretty uncommon to have to deal with fragmentation. After about 2000 filesystem allocation implementations started avoiding it like the plague.

[tjoff]

It is hard to avoid it when streaming a video of unknown length to disk though.

And as soon as you start to fill up your volume fragmentation will spread quickly.