Recover Deleted Files With Scalpel
Recover Deleted Files With ScalpelVersion 1.0 Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery. This short article shows how you can use Scalpel to recover deleted files. I do not issue any guarantee that this will work for you!
1 Preliminary NotePlease note that there's no guarantee that Scalpel will succeed in recovering your files, but at least there's a chance.
2 Installing ScalpelOn Debian and Ubuntu, Scalpel can be installed as follows: apt-get install scalpel
3 Using ScalpelTake a look at man scalpel to learn how to use Scalpel. Before we can use Scalpel, we must define some file types that Scalpel should search for in /etc/scalpel/scalpel.conf. By default, all file types are commented out. In this example, I want to search for deleted PDF files, so I uncomment the following lines: vi /etc/scalpel/scalpel.conf [...]
pdf y 5000000 %PDF %EOF\x0d REVERSE
pdf y 5000000 %PDF %EOF\x0a REVERSE
[...]
Scalpel can be used as follows to try to recover the files: scalpel /dev/sda1 -o output -o defines the directory where Scalpel will place the recovered files - in this case the directory is named output and is a subdirectory of the directory where we are running the scalpel command from; the directory must not exist because otherwise scalpel will refuse to start. (If you don't know what partition to search, take a look at mount server1:~# mount ) After Scalpel has finished, you will find a folder called output in the directory from where you called Scalpel: ls -la server1:~# ls -la ls -l output server1:~# ls -l output The audit.txt contains a summary of what Scalpel has done: cat output/audit.txt server1:~# cat output/audit.txt And the pdf-0-0/ subdirectory contains the jpg files that Scalpel has recovered: ls -l output/pdf-0-0/ server1:~# ls -l output/pdf-0-0/ Before you run Scalpel the next time from the same directory, you must either delete/rename the current output/ directory (because Scalpel will not start if the output directory is already existing) or use specify another output directory.
4 Links
|
Join the discussion.
www.seamlessenterprise.com
IP Convergence
Integrate your wireless and wireline networks.
Learn how from the experts at Sprint.
www.seamlessenterprise.com
Wireless & Wireline Integration
Thoughts, strategies and solutions: join the discussion
www.seamlessenterprise.com
Unified Communications 2009
Join the Discussion. Now.
www.seamlessenterprise.com
Red Hat Virtual Experience - a free virtual event. Dec. 9th







Recent comments
21 hours 18 min ago
1 day 54 min ago
1 day 2 hours ago
1 day 11 hours ago
1 day 13 hours ago
1 day 14 hours ago
1 day 16 hours ago
1 day 16 hours ago
1 day 19 hours ago
2 days 39 min ago