Hi,
I'm using scalpel, a Linux-based utility, to recover MOV video files from a 250 Gb hard drive.
For this, in scalpel's configuration file, I activated the several signatures that were available for ".mov" files.
The first pass, which is scanning the hard drive is complete, as well as the step of work queues allocation.
But for about two hours, scalpel seems frozen on the "Building carve lists…" message.
Is this normal ?
In the past, I remember having seen the pass 2, where scalpel extracts content and save it to files. But I could not tell how long it took to build the carve lists, as I was not present when this occured.
The processor is 1,7 GHz, single core, and the RAM is 1,0 or 1,5 GB.
This is the first time that I'm running scalpel under Kubuntu 10.04 LTS, but I cannot see why another desktop environment could make scalpel freeze at some step.
(Prior experiences were with Ubuntu 10.04 LTS.)
More files signatures (~6) were activated than in previous attempts.
Could there be some conflict between signatures or insufficient RAM ?
Thanks for your help.
The "Building carve lists…" step took to Scalpel a few hours on 250 GB hard drive.
The file signature for MOV files in scalpel, whose started with four "????" jokers gave a lot of false positives. Maybe using "\x00\x00\x00\x00" instead –at least for some of the MOV files signatures– would have be more efficient.