Using Scalpel on Un...
 
Notifications
Clear all

Using Scalpel on Unallocated Space without dumping?  

  RSS
Phorensik
(@phorensik)
New Member

I need to run scalpel on the unallocated space of a raw image. Based on everything I read online, this is done by first dumping the unallocated space to another file using blkls, and then running scalpel on that. However due to disk space constraints, this may not be possible. I don't see why scalpel can't theoretically run against the unallocated space on the raw image itself, without dumping. Is there anyway to do this currently?

Quote
Posted : 10/05/2019 4:20 pm
Phorensik
(@phorensik)
New Member

update, this is not possible using scalpel
https://github.com/sleuthkit/scalpel/issues/36

ReplyQuote
Posted : 10/05/2019 6:51 pm
Share: