EnglishFrenchSpanish

OnWorks favicon

scalpel - Online in the Cloud

Run scalpel in OnWorks free hosting provider over Ubuntu Online, Fedora Online, Windows online emulator or MAC OS online emulator

This is the command scalpel that can be run in the OnWorks free hosting provider using one of our multiple free online workstations such as Ubuntu Online, Fedora Online, Windows online emulator or MAC OS online emulator

PROGRAM:

NAME


scalpel - Recover files using a header/footer database

SYNOPSIS


scalpel [-b] [-c <file>] [-d] [-h] [-i <file>] [-m <blocksize>] [-n] [-o <dir>] [-O] [-p]
[-r] [-s <num>] [-t] [-u] [-V] [-v] [FILES]...

DESCRIPTION


Recover files from a disk image or raw block device based on headers and footers specified
by the user.

-b Carve files even if defined footers aren't discovered within maximum carve size for
file type [foremost 0.69 compat mode]

-c file
Chooses which configuration file to use. If this option is omitted, then
"scalpel.conf" in the current directory is used. The format for the configuration
file is described in the default configuration file "scalpel.conf". See the
CONFIGURATION FILE section below for more information.

-d Generate header/footer database; will bypass certain optimizations and discover all
footers, so performance suffers. Doesn't affect the set of files carved.
**EXPERIMENTAL**

-m Generate/update carve coverage blockmap file. The first 32bit unsigned int in the
file identifies the block size. Thereafter each 32bit unsigned int entry in the
blockmap file corresponds to one block in the image file. Each entry counts how
many carved files contain this block. Requires more memory and disk.
**EXPERIMENTAL**

-h Show a help screen and exit.

-i file
file is used as a list of input files to examine. Each line in the specified file
should contain a single filename.

-o directory
Recovered files are written to the directory directory. Scalpel requires that
this directory be either empty or not exist. The directory will be created if
necessary.

-O Don't organize carved files by type. Default is to organize carved files into
subdirectories to make previewing of large numbers of carved files easier.

-p Perform image file preview; audit log indicates which files would have been carved,
but no files are actually carved.

-q clustersize
Carve only when header is cluster-aligned.

-r Find only first of overlapping headers/footers [foremost 0.69 compat mode]

-s number
Skips number bytes in each input file before beginning the search for file headers
and footers.

-t Set directory for coverage blockmap. **EXPERIMENTAL**

-u Use carve coverage blockmap when carving. Carve only sections of the image whose
entries in the blockmap are 0. These areas are treated as contiguous regions.
**EXPERIMENTAL**

-V Show copyright information and exit.

-v Enables verbose mode. This causes copious amounts of debugging information to be
output.

CONFIGURATION FILE


The configuration file is used to control the types of files Scalpel will attempt to
carve. A sample configuration file, "scalpel.conf", is included with this distribution.
For each file type, the configuration file describes the file's extension, whether the
header and footer are case sensitive, the maximum file size, and the header and footer for
the file. The footer field is optional, but the header, size, case sensitivity, and
extension fields are required.

Important note: The default configuration file has all supported file patterns commented
out--you must edit this before before running Scalpel.

Any line in the configuration file that begins with a pound sign is considered a comment
and ignored.

Headers and footers are decoded before use. To specify a value in hexadecimal use
\x[0-f][0-f], and for octal use \[1-9][1-9][1-9]. Spaces can be represented by \s.
Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".

To match any single character (aka a wildcard) use a '?'. If you need to search for the
'?' character, you will need to change the 'wildcard' line *and* every occurrence of the
old wildcard character in the configuration file, including those appearing in hex and
octal values. '?' is equal to \x3f and \063.

AUTHORS


Written by Golden G. Richard III. The first version of Scalpel was based on foremost
0.69, which was written by Special Agent Kris Kendall and Special Agent Jesse Kornblum of
the United States Air Force Office of Special Investigations.

Use scalpel online using onworks.net services


Free Servers & Workstations

Download Windows & Linux apps

  • 1
    strace
    strace
    The strace project has been moved to
    https://strace.io. strace is a
    diagnostic, debugging and instructional
    userspace tracer for Linux. It is used
    to monitor a...
    Download strace
  • 2
    gMKVExtractGUI
    gMKVExtractGUI
    A GUI for mkvextract utility (part of
    MKVToolNix) which incorporates most (if
    not all) functionality of mkvextract and
    mkvinfo utilities. Written in C#NET 4.0,...
    Download gMKVExtractGUI
  • 3
    JasperReports Library
    JasperReports Library
    JasperReports Library is the
    world's most popular open source
    business intelligence and reporting
    engine. It is entirely written in Java
    and it is able to ...
    Download JasperReports Library
  • 4
    Frappe Books
    Frappe Books
    Frappe Books is a free and open source
    desktop book-keeping software that's
    simple and well-designed to be used by
    small businesses and freelancers. It'...
    Download Frappe Books
  • 5
    Numerical Python
    Numerical Python
    NEWS: NumPy 1.11.2 is the last release
    that will be made on sourceforge. Wheels
    for Windows, Mac, and Linux as well as
    archived source distributions can be fou...
    Download Numerical Python
  • 6
    CMU Sphinx
    CMU Sphinx
    CMUSphinx is a speaker-independent large
    vocabulary continuous speech recognizer
    released under BSD style license. It is
    also a collection of open source tools ...
    Download CMU Sphinx
  • More »

Linux commands

Ad