Notifications
Clear all

SCALPEL  

  RSS
n00bcfe
(@n00bcfe)
New Member

I'm trying to use Scalpel to carve some files. I know I can point the tool to an image file. However, I am trying to point it directly at a device and it does not appear to be working.

[email protected]~$ scalpel /dev/sdc -o /home/ubuntu/Desktop/TEST/TEST/
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "/dev/sdc"

ERROR Couldn't open input file /dev/sdc -- No such file or directory
Scalpel was unable to open the image file /dev/sdc
Skipping...

Scalpel is done, files carved = 0, elapsed = 0 seconds.

This tool may not support this functionality. I wanted to ping the masses to see if this was possible. I will probably just mess with foremost, as I know it supports this functionality.

Quote
Posted : 25/04/2014 12:49 am
jhup
 jhup
(@jhup)
Community Legend

What is in your scalpel.conf?The default config carves no files.

ReplyQuote
Posted : 25/04/2014 4:06 am
a.nham
(@a-nham)
Junior Member

What I think you need to first do is the" fdisk -l" command (linux command that lists all the devices on your computer recognized by your os) to see if /dev/sdc is recognized by your OS first. Sometime you have more devices than you think, like sdc may be a card reader and not the card, which is sdd (fdisk -l for that too). The raw image should not a problem and can't imagine why scalpel would have less support than foremost which is often viewed as its predecessor and is not longer supported.

However, as jhup said, you will also need to remove the # in the scalpel.conf file for it to carve what you desire. If you are not using the default one, you also need to define where it is as well.

ReplyQuote
Posted : 25/04/2014 7:57 am
Share: