13 lines
530 B
Plaintext
13 lines
530 B
Plaintext
Scalpel is a fast file carver that reads a database of header
|
|
and footer definitions and extracts matching files or data
|
|
fragments from a set of image files or raw device files. Scalpel is
|
|
filesystem-independent and will carve files from FATx, NTFS, ext2/3,
|
|
HFS+, or raw partitions. It is useful for both digital forensics
|
|
investigation and file recovery.
|
|
|
|
To use it, you MUST have a conf file that defines the file types
|
|
you want to recover. Use the example scalpel.conf file from
|
|
/usr/doc/scalpel
|
|
|
|
See the man page for details.
|