Scalpel is a fast file carver that reads a database of header
and footer definitions and extracts matching files or data
fragments from a set of image files or raw device files. Scalpel is
filesystem-independent and will carve files from FATx, NTFS, ext2/3,
HFS+, or raw partitions. It is useful for both digital forensics
investigation and file recovery.
To use it, you MUST have a conf file that defines the file types
you want to recover. Use the example scalpel.conf file from
/usr/doc/scalpel
See the man page for details.
8aa1dd4610