Scalpel Version 1.60

Golden Richard released version 1.60 of his file carver Scalpel. This version for the first time supports the concept of in-place carving.

A single invocation of "make" is all what is needed to compile Scalpel. The archive also contains a precompiled binary for the Microsoft Windows platform.

There's only a single slight change to the default configuration file (scalpel.conf): the footer signature for GIF98a graphic files has been modified.

The -p option allows to preview a disk image. In preview mode Scalpel reports the position of hits, but doesn't create the files. This can be used to identify interesting regions within an image at a high speed.

The -m <blocksize> option creates a map of the caved image. Therefore the image is virtually split into blocks of the given size. The map file then contains the hit count per block. At a later time Scalpel can use this map when directed by the -u option. Please note that both options are experimental.

Archives

Imprint

This blog is a project of:
Andreas Schuster
Im Äuelchen 45
D-53177 Bonn
impressum@forensikblog.de

Copyright © 2005-2012 by
Andreas Schuster
All rights reserved.
Powered by Movable Type 5.12