diff --git a/pages/linux/scalpel.md b/pages/linux/scalpel.md new file mode 100644 index 0000000000..77a52fd8af --- /dev/null +++ b/pages/linux/scalpel.md @@ -0,0 +1,29 @@ +# scalpel + +> Recover files from a disk image based on file headers and footers. +> File patterns must be enabled in the configuration file (all are commented out by default). +> More information: . + +- Carve files from a disk image using a specific configuration file: + +`scalpel -c {{path/to/scalpel.conf}} -o {{path/to/output_directory}} {{path/to/disk_image.dd}}` + +- Preview which files would be carved, without actually carving them: + +`scalpel -p -c {{path/to/scalpel.conf}} -o {{path/to/output_directory}} {{path/to/disk_image.dd}}` + +- Skip the first N bytes of the disk image before carving: + +`scalpel -s {{number}} -c {{path/to/scalpel.conf}} -o {{path/to/output_directory}} {{path/to/disk_image.dd}}` + +- Carve files without organizing them into subdirectories by type: + +`scalpel -O -c {{path/to/scalpel.conf}} -o {{path/to/output_directory}} {{path/to/disk_image.dd}}` + +- Display help: + +`scalpel -h` + +- Display version: + +`scalpel -V`