Question
What is the significance of the numbers in a carved file's name?
Answer
FTK assigns names like "Carved[xxxxx].jpg".
The number within the brackets is the byte decimal offset count from the first byte of the parent file from which the file was carved.
Examples
File name: Carved[12345].jpg
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[unallocated space]/006350>>Carved[12345].jpg
Interpretation: The carved file was found beginning at decimal byte offset 12345 within the unallocated chunk "006350".
File name: Carved[789].bmp
Path: Mantooth2.E01/Partition 1/MANTOOTH [NTFS]/[root]/Documents/MyFile.doc>>Carved[789].bmp
Interpretation: The carved file was found beginning at decimal byte offset 789 within "MyFile.doc".
Overview
A carved file, by definition, is a file that is not recorded in the file system records but can found within another data stream. Carved files do not have names or metadata, so FTK assigns its own names.