Comments on Recover Deleted Files With Scalpel

shouldn't be needed, no.

Hi, is it necessary to mount the partition to be scanned?

Am a bit confused by all the hex.

Say I want to recover JPG files that are all in subdirectories on the disk, can I just write a line in the conf file saying :

         jpg       y        200000000       %JPG

 Will this find all jpg files in all subdirs or only the jpg files that end in JPG (capitals)

Nope!

Under Windows a jpg file must end in .jpg, or else Windows won't know what programme to use to open it.  In Linux however the terminations are optional. Linux identifies filetype by looking at the first few characters contained within the file. If you look at the contents of a bmp file the first 2 characters are BM, but with other file types which are stored in binary format, such as zip files the signature may contain non-printable characters - hence the hexadecimal signatures in scalpel.conf.

Why the output I get is

 /media/johnwalker/58bc0754-1b7f-4875-a90e-4983f06bc78a/: 100.0% |*******************|    4.0 KB    00:00 ETAProcessing of image file complete. Cleaning up...
Done.
Scalpel is done, files carved = 0, elapsed = 0 seconds.

even though mounted volume is 54 GB? And program finishes work in a second. What I am doing wrong?

You need to run it against '/dev/[device]', not '/media/[device]'. Like it says, run 'mount' and you'll see which one it is in the list.

The link to scalpel seems to have died... anyone have a mirror of it?

Hi 

 Scalpel has been integrated into Sleuthkit, the git repository can be found here: https://github.com/sleuthkit/scalpel 

Cheers
LGM 

Scalpel has been incorporated in Sleuthkit, so where the above tutorial says to install scalpel using:

apt-get install scalpel

 instead run:

 apt-get install sleuthkit

which will install scalpel as well as a number of other useful tools, see: https://github.com/sleuthkit 

Is it possible to detect specific file name, Please tell me how to recover my file. myfilename.Keystore is my file name can you tell me how to recover it.

Unable to recover files from scalpel in centos 6.0 while trying to recover .odt files after editing the scalpel.conf file.

Receiving errors as follows

ERROR: Couldn't open configuration file:

scalpel.conf -- No such file or directory

Scalpel was unable to read a needed file and will abort.

$ scalpel /dev/sdb1 -o output

Scalpel version 2.1

Written by Golden G. Richard III and Lodovico Marziale.

ERROR: Couldn't open configuration file:

scalpel.conf -- No such file or directory

Scalpel was unable to read a needed file and will abort.

Unexpected error while reading search spec file. 

quote:

ERROR: Couldn't open configuration file:

scalpel.conf -- No such file or directory

Scalpel was unable to read a needed file and will abort.

You must specify a configuration file with the -c option.

Copy the file  "/etc/scalpel/scalpel.conf"

somewhere... example: "/root/.config/scalpel/scalpel_002.conf"

and change its content as you like.

Then give...

scalpel  -c /WHERE/THE/NEW/CONF/FILE/IS  THE-REST-OF-THE-COMMAND

example...

scalpel  -c /root/.config/scalpel/scalpel_002.conf -o /mnt/hd/files/scalpel-output  /mnt/hd/iso/some-disk.iso

is this able to recover .xls files?

I have tried to change the conf file but I think my hex headers are still wrong?

Anyone have any luck with .xls?

cheers

How do i use this to search for *.h/*.hpp/*.c/*.cpp files? I saw *.txt but with PGP? Or UTF-8 encoded text-files?