Join Us!

scalpel ERROR: Coul...
 
Notifications
Clear all

[Solved] scalpel ERROR: Couldn't open input file  

  RSS
Tony75
(@tony75)
New Member

Hi

I try to run scalpel against raw file usb.001 but i get this error below, How can I solve this problem

I have raw fine on  my kali linux Desktop !

I run scalpel in kali linux 2020.2

[email protected]:~/Desktop$ sudo scalpel -i usb.001 -o sr1
[sudo] password for kali:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "/home/kali/Desktop/3��м"

ERROR: Couldn't open input file: 3��м -- No such file or directory
Scalpel was unable to open the image file: 3��м
Skipping...


Opening target "/home/kali/Desktop/3��м"

Segmentation fault



 
Quote
Posted : 01/07/2020 1:46 am
Topic Tags
Rich2005
(@rich2005)
Active Member

Try

scalpel -c scalpel.conf -o sr1 usb.001

or

scalpel -c scalpel.conf -o /home/kali/Desktop/sr1 /home/kali/Desktop/usb.001

ReplyQuote
Posted : 01/07/2020 8:07 am
Tony75 liked
Tony75
(@tony75)
New Member

@rich2005

It seems I got same error?

 

[email protected]:/home/kali/Desktop# scalpel -c /etc/scalpel/scalpel.conf -i USB.001 -o sr1
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "`�aN"

Segmentation fault
[email protected]:/home/kali/Desktop#
ReplyQuote
Posted : 01/07/2020 3:54 pm
Rich2005
(@rich2005)
Active Member

You've not run the same command I wrote 😉

ReplyQuote
Posted : 01/07/2020 3:58 pm
Tony75 liked
Tony75
(@tony75)
New Member

@rich2005

Thanks its work very fine now by removing -i

Thanks again

both work

[email protected]:/home/kali/Desktop# scalpel USB.001 -o scalpel_output

[email protected]:/home/kali/Desktop# scalpel -c /etc/scalpel/scalpel.conf USB.001 -o sr2
ReplyQuote
Posted : 01/07/2020 4:05 pm
Rich2005
(@rich2005)
Active Member

OK no worries 🙂

ReplyQuote
Posted : 01/07/2020 4:07 pm
athulin
(@athulin)
Community Legend
Posted by: @tony75

@rich2005

Thanks its work very fine now by removing -i

Thanks again

both work

[email protected]:/home/kali/Desktop# scalpel USB.001 -o scalpel_output

[email protected]:/home/kali/Desktop# scalpel -c /etc/scalpel/scalpel.conf USB.001 -o sr2

Have you come to any conclusion to what your problem actually was?  While being able to get around the problem is fine in some situations, it does not clearly help in future cases. 

From where I am, it seems that your use of the -i option together with the image file was incorrect. That is, the part

... -i usb.001

That is not how you use -i.

The scalpel man page should tell you why.

I would also recommend avoiding going too far from the command line syntax as documented in that man page: one day, that syntax may be strictly enforced, and that day you will probably have a new problem, especially if you have built scripts using the syntax in the examples above.

This post was modified 4 days ago by athulin
ReplyQuote
Posted : 01/07/2020 5:18 pm
Tony75 liked
Tony75
(@tony75)
New Member

@athulin

I used many times scalpel with –i option but unfortunately this time gave me error and I don’t know the reason still?

But it must work with –i option!

-i Read names of disk images from specified file.
This post was modified 4 days ago by Tony75
ReplyQuote
Posted : 01/07/2020 6:57 pm
athulin
(@athulin)
Community Legend

@tony75

It almost certainly does work with the -i option.  (I haven't tested it, so there just might be problems. )

But note what the man page says:

Read names of disk images from specified file.

That is, the -i file is supposed to contain names/paths of your disk image files. It provides a indirection level.  It's not useful if you have only one single image file: it would be unneccessary work to use it that way, even though it is possible.

That is, -i is the kind of thing you use when you have several image files, and you either aren't able to get them in the correct order by use of other Unix tools (ls etc.), or if the list gets too long for one command line. So, you put all the names in the correct order in a file, and then use '-i file_with_all_image_file_paths_in_correct_order'.

Is that how you used it?  By your original posting, you specified the image file itself -- and that probably explains why you got some weird characters in the error messages, and probably also why you got two 'Opening target' logs, instead of only one as would be expected.

The man page could be clearer on this, but I also think the current description is at the normal level of most Unix commands. The reading of Unix/Linux man pages, like some mechanical activities not usually associated with computer forensics, often requires great calm of mind.

This post was modified 4 days ago 3 times by athulin
ReplyQuote
Posted : 01/07/2020 7:30 pm
Tony75 liked
jaclaz
(@jaclaz)
Community Legend
Posted by: @athulin

The man page could be clearer on this, but I also think the current description is at the normal level of most Unix commands. The reading of Unix/Linux man pages, like some mechanical activities not usually associated with computer forensics, often requires great calm of mind.

I will translate that in non-politically correct terms as "the specific scalpel man page sucks exactly as much as  all other man pages".

Example:

Name

scalpel - Recover files or data fragments from a disk image using filetype-specific patterns

Synopsis

scalpel [-b] [-c ] [-d] [-e] [-h] [-i ] [-n] [-o

] [-O] [-p] [-q ] [-r] [-V] [-v] [FILES]...

Description

Recover files from a disk image or raw block device based on headers and footers specified by the user.

 

So the tool is intended to extract "files" from "a disk image" (or "raw block device")

In synopsys [FILES] should then be [Disk Image | Raw Block device]

Singular, not plural.

And the [-i ] should actually be [-i ] or [-i ]

Still, the specific usage of -i is - exceptionally - clear enough, as it is explained later:

-i file
file is used as a list of input files to examine. Each line in the specified file should contain a single filename.

though it may well do with:

-i file list
file list is used as a list of input Disk images or Raw Block Devices to examine. Each line in the specified file should contain a single filename.

As a side note usb.001 and USB.001 may or may not be the same thing in 'nix.

jaclaz

 

ReplyQuote
Posted : 02/07/2020 9:29 am
Tony75 liked
jaclaz
(@jaclaz)
Community Legend
Posted by: @jaclaz

 

And the [-i ] should actually be [-i ] or [-i ]

 

For some reasons the stupid board software interprets tags it cannot understand, let's see if CODE works:

And the [-i ] should actually be [-i ] or [-i ]

Edit, no, it doesn't (in CODE this is a SERIOUS issue).

And the [-i < file >] should actually be [-i < disk image list >] or [-i < file list >]

A space is needed to let the greater than and less than sign to show, which plainly means that any HTML, XML or batch with redirection snippets are likely to be or become botched.

jaclaz

This post was modified 3 days ago 2 times by jaclaz
ReplyQuote
Posted : 03/07/2020 10:34 am
Jamie
(@jamie)
Community Legend
Posted by: @jaclaz
Posted by: @jaclaz

 

And the [-i ] should actually be [-i ] or [-i ]

 

...

I'll look into it.

ReplyQuote
Posted : 03/07/2020 2:13 pm
Share: