Scalpel - Data Recovery tool for Linux

Scalpel is the common file recovery tool that carves files with the help of the Boyer-Moore string checks to find the footers and headers in a disk image. Via these techniques, we can basically carve the file on the disk which was sculpted during the time it takes to read it. Scalpel can slice FATx, NTFS, ext2/3, or raw partition files independently of the file system. It helps research and digital forensics.

Installation:

It’s an inbuilt utility of Kali Linux, so for installing from the packages utility into the front line, you have to type, sudo apt install scalpel -y.

Before Starting with Scalpel, you have to check whether the USB Drive is actually showing on Kali Linux or not. For this, we have to use the command: sudo fdisk -l. (In this scenario we are using SanDisk 8 GB USB Drive)

FDISK Results

• Here it shows under the substantial path which is /dev/sdb1 with 7.5G of size means the USB Drive is inserted successfully and showing as well.
• Before initializing, we have to make changes to the configuration file. The file is stored in /etc/scalpel and the name of the file is scalpel.conf. Just nano or gedit it to make changes. 

Editing the file

• Here you can find various file types mentioned that we can recover. Just remove "#" from there. Let's try for the JPG file type. So remove the hash from lines 87 and 88 and save the file.

Removing HASHes

If the configuration file gives an error upon saving. You have to open the file with sudo (for actual root permission), sudo gedit scalpel.conf.

• Now for a better understanding of the tool, type, scalpel -h.

Help Options

• The main command that we need to focus on here is the -o command, which is for output. We have to write the actual USB substantial (/dev/sdb1) command along with -o and the destination path where the file would be saved.

File Recovery Process

• Now you can check the destination folder for the files which was recovered. 

Recovered Files

Similarly, you can go to the configuration file (scalpel.conf) and put the comment (#) back into JPG (on lines 87 & 88). Remove the comment from the front of the file type you want to recover like PDF, DOCX, etc. You can also recover multiple files at one time.

We hope this helps. If any suggestions or doubts you can add a comment and we will reply as soon as possible.