Data carving with Scalpel
Scalpel was created as an improvement of a much earlier version of Foremost. Scalpel aims to address the high CPU and RAM usage issues of Foremost when carving data.
Unlike Foremost, file types of interest must be specified by an investigator in the Scalpel configuration file. This file is called scalpel.conf and is located at etc/scapel/:
Figure 9.16 – The Scalpel configuration file
To specify the file types, the investigator must remove the comments at the start of the line containing the file type, as all supported file types are commented out with a hashtag at the beginning of the file type. The following screenshot shows the default Scalpel configuration file (scalpel.conf) with all file types commented out. Note that each line begins with a hashtag:
Figure 9.17 – Scalpel file types within the conf file
I’ve removed the hashtags at the beginning of some of the lines to...
