Specifying file types in Scalpel

Unlike Foremost, file types of interest must be specified by the investigator in the Scalpel configuration file. This file is called scalpel.conf and is located at etc/scapel/:

To specify the file types, the investigator must remove the comments at the start of the line containing the file type as all supported file types are commented out with a hashtag at the beginning of the file type. The following screenshot shows the default Scalpel configuration file (scalpel.conf) with all file types commented out. Notice that each line begins with a hashtag:

We've removed the hash tags at the beginning of some of the lines to let Scalpel know to search for these specific file types, this also reduces the time taken to otherwise search for all supported file types. The following screenshot shows that Scalpel will be searching for GIF and JPG files as the comments have been removed:

Be sure to perform this step before specifying the image to be carved. Failure to do so presents the investigator with a helpful error message reminding them to do so.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset