Find the answer to your Linux question:
Results 1 to 4 of 4
I am using Scalpel to do some data recovery from a disk but the config file at /etc/scalpel/scalpel.conf does not have all of the file types that I'd like to ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Feb 2010
    Posts
    2

    Master configuration file for Scalpel


    I am using Scalpel to do some data recovery from a disk but the config file at /etc/scalpel/scalpel.conf does not have all of the file types that I'd like to recover.

    Supposedly it will recover any file type if the header format is known. So, does anyone have a more complete conf file than the default? Perhaps with MP3 and other file types?

    Thanks in advance

  2. #2
    Linux Guru reed9's Avatar
    Join Date
    Feb 2009
    Location
    Boston, MA
    Posts
    4,651
    The sample scalpel.conf file should have all supported file types included (though commented out). Is that not the case with yours?

    Linux Certif - Man scalpel(1)
    Important note: The default configuration file has all supported file patterns commented out--you must edit this before before running Scalpel.

  3. #3
    Just Joined!
    Join Date
    Feb 2010
    Posts
    2
    Hi reed9 -

    The sample configuration file that I have does include all of the default file types that Scalpel will search for. However, there are some additional file-types that I think can be configured to in the file and which Scalpel will be able to identify.

    After researching a bit more I don't think that MP3 files are able to be recovered by Scalpel because they lack the correct header information. I will attempt to recover these with a different program such as Photorec.

    Some files that were lost were test based files like PHP and SQL scripts, I have not found a way to recover them yet, they do not appear in my scalpel.conf file either so any help or additional information on how to recover those files would be appreciated.

    P.S. Here is some additional information on MP3 files
    ===============================================
    Mp3’s do not have file headers, so any program that recognizes files or file types based on header information will not be able to make sense of an mp3 file (or the remains of one). The “footer” of an mp3 file, if it exists, (i.e. the optional ID3 metadata) is also fairly useless from this standpoint. Apart from being very freeform in terms of how it is arranged, it doesn’t provide enough information to figure out the actual size of the file. One can make a reasonably educated guess based on bitrate and song length (if both are present), but even for constant bit rate files, this won’t really get you close enough to do anything useful.
    ===============================================

    Thanks.

  4. #4
    Just Joined!
    Join Date
    Feb 2012
    Posts
    1
    This is probably the master file that you're looking for:
    https:// raw.github.com/int0x80/anti-forensics/master/scalpel.conf

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •