Linux command
scalpel 命令
文件
复制后可按需替换文件名、目录或参数。
常用示例
Carve files from image
scalpel -o [output_dir] [disk.img]
Use custom config
scalpel -c [scalpel.conf] -o [output] [disk.img]
Carve from device
sudo scalpel -o [output] [/dev/sda]
Preview without carving
scalpel -p -o [output] [disk.img]
说明
scalpel is a file carving tool that recovers files based on file headers, footers, and data structures. It's faster and more memory-efficient than foremost. The tool extracts files from disk images or devices regardless of filesystem state, useful for data recovery and forensics.
参数
- -o _dir_
- Output directory.
- -c _file_
- Configuration file.
- -b _num_
- Block size in bytes.
- -p
- Preview mode (no extraction).
- -e
- Skip block alignment.
- -v
- Verbose output.
- -r
- Find only matching files.
FAQ
What is the scalpel command used for?
scalpel is a file carving tool that recovers files based on file headers, footers, and data structures. It's faster and more memory-efficient than foremost. The tool extracts files from disk images or devices regardless of filesystem state, useful for data recovery and forensics.
How do I run a basic scalpel example?
Run `scalpel -o [output_dir] [disk.img]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -o _dir_ do in scalpel?
Output directory.