SlackBuilds Repository

15.0 > System > scalpel (2.0)

Scalpel is a fast file carver that reads a database of header
and footer definitions and extracts matching files or data
fragments from a set of image files or raw device files. Scalpel is
filesystem-independent and will carve files from FATx, NTFS, ext2/3,
HFS+, or raw partitions. It is useful for both digital forensics
investigation and file recovery.

To use it, you MUST have a conf file that defines the file types
you want to recover. Use the example scalpel.conf file from
/usr/doc/scalpel

See the man page for details.

This requires: tre

Maintained by: Klaatu
Keywords: recovery,undelete,rescue,carve,foremost
ChangeLog: scalpel