Recovering files with scalpel.
Posted by jpluimers on 2021/04/19
I missed this 2014 article [WayBack] Recovering Deleted Files with Scalpel » Linux Magazine:
The Scalpel file carver helps users restore what they thought were lost files.
Via the now defunct G+ link: https://plus.google.com/+Doortodoorgeek/posts/eskyp8PH57a?_utm_source=1-2-2 from which I saved this quote:
+honkey Magoo recovering with Photorec can be hard, I had a touch more luck with this one
Scalpel File Carver: http://www.linux-magazine.com/Online/Features/Recovering-Deleted-Files-with-Scalpel
I wish it had been maintained longer, as the most recent changes are indeed from 2014: [WayBack] GitHub – sleuthkit/scalpel: Scalpel is an open source data carving tool. (it is now indeed part of Sleuthkit, see [WayBack] Scalpel – ForensicsWiki)
So basically this was a short revival: WayBack: Digital Forensics Solutions: Announcing Scalpel 2.0.
–jeroen
PS: 20210420; Joseph Mitzen suggested using PhotoRec – Wikipedia, which still is maintained:
[Archive.is] Joseph Mitzen on Twitter: “I’ve used photorec, which managed to find over two million files on a btrfs partition last year that was so screwed up it was neither mountable nor even recognized as a btrfs partition at that point! … “
.
Leave a Comment