Using Scalpel on Un...
 
Notifications
Clear all

Using Scalpel on Unallocated Space without dumping?

2 Posts
1 Users
0 Likes
516 Views
Phorensik
(@phorensik)
Posts: 3
New Member
Topic starter
 

I need to run scalpel on the unallocated space of a raw image. Based on everything I read online, this is done by first dumping the unallocated space to another file using blkls, and then running scalpel on that. However due to disk space constraints, this may not be possible. I don't see why scalpel can't theoretically run against the unallocated space on the raw image itself, without dumping. Is there anyway to do this currently?

 
Posted : 10/05/2019 3:20 pm
Phorensik
(@phorensik)
Posts: 3
New Member
Topic starter
 

update, this is not possible using scalpel
https://github.com/sleuthkit/scalpel/issues/36

 
Posted : 10/05/2019 5:51 pm
Share: