blob: 60efafb3f510d46aaf97f122ee9c29b626af5f43 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
|
Scalpel is a fast file carver that reads a database of header
and footer definitions and extracts matching files or data
fragments from a set of image files or raw device files. Scalpel is
filesystem-independent and will carve files from FATx, NTFS, ext2/3,
HFS+, or raw partitions. It is useful for both digital forensics
investigation and file recovery.
To use it, you MUST have a conf file that defines the file types
you want to recover. Use the example scalpel.conf file from
/usr/doc/scalpel
See the man page for details.
|
