Using Scalpel for file carving

Once we have made our changes to include file types and saved the scalpel.conf file, we can then start Scalpel by clicking on the Show Applications button on the sidebar and enter scalpel into the search box which then appears at the top of the screen, as seen here. Click on the scalpel box to begin:

Once started, a Terminal opens showing the version number (1.60), the author (Golden G. Richard III), and as mentioned, states that it is based on Foremost 0.69. As seen with Foremost, Scalpel-usage syntax and additional options are also displayed:

For this example, the same image used for carving with Foremost (11-carve-fat.dd) was used. As with Foremost also, the input file and output folder must be specified. To list the available options and switches in Scalpel, use scalpel -h.

The following syntax was used in Scalpel:

scalpel -o scalpelOutput/ 11-carve-fat.dd

In the previous screenshot, we can see that Scalpel builds a carve-list showing the file type with header and footer information as well as the number of files carved.

Taking a closer look at the last few lines produced by the Scalpel output, we can see that the carving process was 100% complete with 18 files being carved:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset