README 1.63 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53
Scalpel is a complete rewrite of the Foremost 0.69 file carver.  This
version of Scalpel reads Foremost 0.69 configuration files--see the
default configuration file, scalpel.conf, for more details.

Important note: The default configuration file has all supported file
patterns commented out--you must edit this before before running
Scalpel.

More details on execution options can be found in the Scalpel man
page, "scalpel.1".

Currently supported operating systems:  Linux, Windows, Mac OS X.

If you decide to compile Scalpel on win32, you'll need to install
pthreads-win32 and hack the Makefile to reflect where you've installed
the pthreads include and lib directories.  If you want to run Scalpel
on win32 w/o these hassles, just use the win32 executable that's
provided in the distribution.


COMPILE INSTRUCTIONS:

Linux:    make

Win32:    make win32 [or mingw32-make win32]

Mac OS X: make bsd

and enjoy.  If you want to install the binary and man page in a more
permanent place, just copy "scalpel" and "scalpel.1" to appropriate
locations, e.g., on Linux,  "/usr/local/bin" and "/usr/local/man/man1", 
respectively.  On Windows, you'll also need to copy "pthreadGC1.dll"
into the same directory as "scalpel.exe".


LIMITATIONS:

Carving Windows physical and logical device files (e.g.,
\\.\physicaldrive0 or \\.\c:) isn't currently supported, but will be supported
in a future release.  


SUGGESTIONS:

Bug reports, comments, complaints, and feature requests should be
directed to the author at golden@digitalforensicssolutions.com.

The latest version of Scalpel is always available at 
http://www.digitalforensicssolutions.com/Scalpel.

Cheers,

--Golden