scalpel

scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files.

scalpel is filesystem-independent and will carve files from FAT16, FAT32, exFAT, NTFS, Ext2, Ext3, Ext4, JFS, XFS, ReiserFS, raw partitions, etc.

Usage

Usage: scalpel [options] [FILES]...

Option	Description
-b	Carve files even if defined footers aren’t discovered within maximum carve size for file type [foremost 0.69 compat mode]. This option may help when fragmentary evidence is useful, but will increase the number of false positives.
-c file	Chooses which configuration file to use. If this option is omitted, then “scalpel.conf” in the current directory is used. The format for the configuration file is described in the default configuration file “scalpel.conf”.
-d	Generate header/footer database. This option forces Scalpel to discover all headers and footers and write header/footer locations to a text file. Since certain optimizations are bypassed when all footers must be discovered, performance will suffer. This option does not affect the set of files that are carved.
-e	Do nested header/footer matching, to deal with structured files that may contain embedded files of the same type. Applicable only to FORWARD / NEXT patterns.
-i file	file is used as a list of input files to examine. Each line in the specified file should contain a single filename.
-o directory	Recovered files are written to the directory directory. Scalpel requires that this directory be either empty or not exist. The directory will be created if necessary.
-n	Don’t add extensions to extracted files.
-o	Set output directory for carved files. Scalpel will only write carved files to an empty output directory. “scalpel-output” in the current directory is the default if this option is not specified.
-O	Don’t organize carved files by type. By default, scalpel organizes carved files into subdirectories, by type.
-p	Perform an image file preview. When this option is specified, the audit log indicates which files would have been carved, but no files are actually carved. This option also supports in-place file carving.
-q	Carve files only when the header is cluster-aligned. If you aren’t interested in carving files embedded within other file types, this option should be used, as it significantly reduces the false positive rate.
-r	Find only first of overlapping headers/footers [foremost 0.69 compat mode]. This option is rarely needed.
-V	Show copyright information and exit.
-v	Enables verbose mode. This causes copious amounts of debugging information to be output.