SCALPEL(1)

💖 SCALPEL(1) 💖

okay so bestie, welcome to scalpel(1) — A Fast Header/Footer-based File Carver ✨ (yes that's literally the whole subtitle, it's giving ✨forensics✨). v1.60, December 2006, we love a vintage icon. let's get into it 🫶

---

✨ NAME ✨

scalpel — recover files using a header/footer database 🎀

---

🌸 SYNOPSIS 🌸

scalpel [-b] [-c <file>] [-d] [-h] [-i <file>] [-m <blocksize>] [-n] [-o
<dir>] [-O] [-p] [-r] [-s <num>] [-t] [-u] [-V] [-v] [FILES]...

---

👑 DESCRIPTION 👑

Recover files from a disk image or raw block device based on headers and footers specified by the user. it's literally carving files out of a big ol' blob, no cap 💅

• -b — carve files even if defined footers aren't discovered within maximum carve size for file type [foremost 0.69 compat mode]. like, we found the header, we're going in, we're not waiting around for a footer that may never come 😤
• -c file — chooses which configuration file to use. if you skip this option, then "scalpel.conf" in the current directory is used. the format for the configuration file is described in the default configuration file "scalpel.conf". see the CONFIGURATION FILE section below for more info 👇
• -d — generate header/footer database; will bypass certain optimizations and discover all footers, so performance suffers. doesn't affect the set of files carved. EXPERIMENTAL ⚠️ (it's giving "science experiment", be careful)
• -m — generate/update carve coverage blockmap file. the first 32bit unsigned int in the file identifies the block size. thereafter each 32bit unsigned int entry in the blockmap file corresponds to one block in the image file. each entry counts how many carved files contain this block. requires more memory and disk. EXPERIMENTAL 💀
• -h — show a help screen and exit. our fave, the lil escape hatch 🏃‍♀️
• -i file — file is used as a list of input files to examine. each line in the specified file should contain a single filename. one name per line, periodt 📝
• -o directory — recovered files are written to the directory directory. Scalpel requires that this directory be either empty or not exist. the directory will be created if necessary. so like… if it's full of stuff, she will NOT be entering 🚫
• -O — don't organize carved files by type. default is to organize carved files into subdirectories to make previewing of large numbers of carved files easier. (ngl the default is lowkey a lifesaver when you've got 4000 little files staring at you 🙈)
• -p — perform image file preview; audit log indicates which files would have been carved, but no files are actually carved. a lil ✨dry run✨, we love a rehearsal
• -q clustersize — carve only when header is cluster-aligned. so picky, so precise 💅
• -r — find only first of overlapping headers/footers [foremost 0.69 compat mode]
• -s number — skips number bytes in each input file before beginning the search for file headers and footers. like scrolling past the boring intro of a video 🎬
• -t — set directory for coverage blockmap. EXPERIMENTAL ⚠️
• -u — use carve coverage blockmap when carving. carve only sections of the image whose entries in the blockmap are 0. these areas are treated as contiguous regions. EXPERIMENTAL 🔥
• -V — show copyright information and exit. 🫶
• -v — enables verbose mode. this causes copious amounts of debugging information to be output. copious. like, an absurd amount. the way that it just keeps going 😭

---

🦋 CONFIGURATION FILE 🦋

The configuration file is used to control the types of files Scalpel will attempt to carve. A sample configuration file, "scalpel.conf", is included with this distribution. For each file type, the configuration file describes the file's extension, whether the header and footer are case sensitive, the maximum file size, and the header and footer for the file. The footer field is optional, but the header, size, case sensitivity, and extension fields are required. ✍️

Important note: The default configuration file has all supported file patterns commented out — you must edit this before before running Scalpel. 🚨 bestie. BESTIE. you HAVE to uncomment stuff first. nothing will happen otherwise. the default config is literally all comments, it's giving "empty group chat" 💀

Any line in the configuration file that begins with a pound sign is considered a comment and ignored. (yes # is the vibe-killer line, it's just notes to self 💬)

Headers and footers are decoded before use. To specify a value in hexadecimal use \x[0-f][0-f], and for octal use \[1-9][1-9][1-9]. Spaces can be represented by \s. Example:

"\x4F\123\I\sCCI"

decodes to:

"OSI CCI"

To match any single character (aka a wildcard) use a '?'. If you need to search for the '?' character, you will need to change the 'wildcard' line and every occurrence of the old wildcard character in the configuration file, including those appearing in hex and octal values. '?' is equal to \x3f and \063. 🌈

---

💜 AUTHORS 💜

Written by Golden G. Richard III. The first version of Scalpel was based on foremost 0.69, which was written by Special Agent Kris Kendall and Special Agent Jesse Kornblum of the United States Air Force Office of Special Investigations. shoutout to the forefathers of file carving, icons honestly 👑✨

---

💀 BUGS AND LIMITATIONS 💀

It is currently not possible to carve physical block devices directly using the Windows version of Scalpel. This is a limitation that will be removed in a future release of Scalpel. so Windows girlies, physical block devices are not on the menu rn 😭 (future release tho, we're manifesting 🙏)

---

🎀 REPORTING BUGS 🎀

When submitting a bug report, please include a description of the problem, how you found it, and your contact information. give us the lore, the backstory, the receipts 🧾

Send bug reports to:

goldenrichard@gmail.com

---

⭐ COPYRIGHT ⭐

This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. no cap, zero warranty, none, don't come for her 💅

---

🌈 SEE ALSO 🌈

More information on Scalpel appears in the README file, distributed with the Scalpel source code. go read the README bestie, it's the director's commentary 📖✨

---

okay that's the whole page, you ate that 🫶 mwah 💖

A Fast Header/Footer-based File Carver — v1.60 — December 2006 — yeah that's the version-and-date energy, thanks for coming to my TED talk, ilysm, bye 👑🌸