summaryrefslogtreecommitdiff
path: root/system/scalpel/README
blob: d4fc9994725d396da7b3d76b741d99306e1bc3d7 (plain)
1
2
3
4
5
6
7
8
9
10
Scalpel is a fast file carver that reads a database of header and footer
definitions and extracts matching files or data fragments from a set of
image files or raw device files. Scalpel is filesystem-independent and will
carve files from FATx, NTFS, ext2/3, HFS+, or raw partitions. It is useful
for both digital forensics investigation and file recovery.

To use it, you MUST have a conf file that defines the file types you want
to recover.  Use the example scalpel.conf file from /usr/doc/scalpel

See the man page for details.