NAME

       scalpel - Recover files using a header/footer database

SYNOPSIS

       scalpel [-b] [-c <file>] [-d] [-h] [-i <file>] [-m <blocksize>] [-n] [-o <dir>] [-O] [-p] [-r] [-s <num>]
       [-t] [-u] [-V] [-v] [FILES]...

DESCRIPTION

       Recover files from a disk image or raw block device based on headers and footers specified by the user.

       -b     Carve  files  even  if  defined  footers aren't discovered within maximum carve size for file type
              [foremost 0.69 compat mode]

       -c file
              Chooses which configuration file to use. If this option is omitted,  then  "scalpel.conf"  in  the
              current  directory  is  used.  The  format  for the configuration file is described in the default
              configuration file "scalpel.conf".  See the CONFIGURATION FILE section below for more information.

       -d     Generate header/footer database; will bypass certain optimizations and discover  all  footers,  so
              performance suffers.  Doesn't affect the set of files carved.  **EXPERIMENTAL**

       -m     Generate/update carve coverage blockmap file.  The first 32bit unsigned int in the file identifies
              the  block  size. Thereafter each 32bit unsigned int entry in the blockmap file corresponds to one
              block in the image file.  Each entry counts how many carved files  contain  this  block.  Requires
              more memory and disk.  **EXPERIMENTAL**

       -h     Show a help screen and exit.

       -i file
              file is used as a list of input files to examine. Each line in the specified file should contain a
              single filename.

       -o directory
              Recovered  files are written to the directory directory.   Scalpel requires that this directory be
              either empty or not exist.  The directory will be created if necessary.

       -O     Don't organize carved files by type. Default is to organize carved files  into  subdirectories  to
              make previewing of large numbers of carved files easier.

       -p     Perform  image  file preview; audit log indicates which files would have been carved, but no files
              are actually carved.

       -q clustersize
              Carve only when header is cluster-aligned.

       -r     Find only first of overlapping headers/footers [foremost 0.69 compat mode]

       -s number
              Skips number bytes in each input file before beginning the search for file headers and footers.

       -t     Set directory for coverage blockmap.  **EXPERIMENTAL**

       -u     Use carve coverage blockmap when carving.  Carve only sections of the image whose entries  in  the
              blockmap are 0.  These areas are treated as contiguous regions.  **EXPERIMENTAL**

       -V     Show copyright information and exit.

       -v     Enables verbose mode. This causes copious amounts of debugging information to be output.

CONFIGURATION FILE

       The  configuration  file  is  used to control the types of files Scalpel will attempt to carve.  A sample
       configuration file, "scalpel.conf",  is  included  with  this  distribution.  For  each  file  type,  the
       configuration  file describes the file's extension, whether the header and footer are case sensitive, the
       maximum file size, and the header and footer for the file. The footer field is optional, but the  header,
       size, case sensitivity, and extension fields are required.

       Important  note:  The  default configuration file has all supported file patterns commented out--you must
       edit this before before running Scalpel.

       Any line in the configuration file that begins with a pound sign is considered a comment and ignored.

       Headers and footers are decoded before use. To specify a value in hexadecimal use \x[0-f][0-f],  and  for
       octal  use \[1-9][1-9][1-9].  Spaces can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI
       CCI".

       To match any single character (aka a wildcard) use a '?'. If you need to search for  the  '?'  character,
       you  will  need to change the 'wildcard' line *and* every occurrence of the old wildcard character in the
       configuration file, including those appearing in hex and octal values. '?' is equal to \x3f and \063.

AUTHORS

       Written by Golden G. Richard III.  The first version of Scalpel was based on  foremost  0.69,  which  was
       written  by  Special  Agent  Kris Kendall and Special Agent Jesse Kornblum of the United States Air Force
       Office of Special Investigations.

BUGS AND LIMITATIONS

       It is currently not possible to carve physical block  devices  directly  using  the  Windows  version  of
       Scalpel.  This is a limitation that will be removed in a future release of Scalpel.

REPORTING BUGS

       When  submitting  a  bug  report, please include a description of the problem, how you found it, and your
       contact information.

       Send bug reports to:
       goldenrichard@gmail.com

COPYRIGHT

       This is free software.  There is NO warranty; not even for MERCHANTABILITY or FITNESS  FOR  A  PARTICULAR
       PURPOSE.

SEE ALSO

       More information on Scalpel appears in the README file, distributed with the Scalpel source code.

A Fast Header/Footer-based File Carver        v1.60 - December 2006                                   SCALPEL(1)