Ubuntu 12.04 Forensics - File Carving using Scalpel

Author: Lecture Snippets
15609 View
7m 17s Lenght
47 Rating

This video is part of a series on Computer Forensics using Ubuntu 12.04. In this Lecture Snippet I install the file carving tool scalpel on Ubuntu 12.04 and use the tool to carve out an image file and a hard drive partition. Scalpel uses a configuration file that must be edited to carve out specific file types.

Comments

  1. Can i recover folders using this?
  2. What happen if I delete a file with the name foo.txt and then I created a new file with the same name? Can I recover the previous file?
  3. Great video, thanks! I am looking for mp4 type of files but are not shown in scalpel.config :(
  4. whats best way to put data into an image on linux (with no password)?
  5. I think what I'm REALLY ASKING IS: "How would I edit the configuration
    file to Carve out files with the extensions: .WRK; .MID; .BUN?
    (Cakwalk Audio Files) ???

    I can't seem to get it from PhotoRec or TestDisk...
  6. Hey!! This explanation was very informative and easy to comprehend......Thank you! I was wondering: How would "I" go about finding out the File Extension Specification for "CAKEWALK SONAR Files" that end with .wrk; .mid; and .bun? If you could tell me THAT, you would've assisted me in Recovering My Original Music Files which I have been without for OVER A YEAR NOW...........Do you have any advise with this? I'm workin' with an IMAGE.DD File which I created from A Dying Hard Drive with Corrupted Files...

    Thanks so much for the explanation; have a good day! (smile)
  7. How to get flashdrive.img ??
  8. Great video, thanks.
    Silly question, what is the difference of using filecarving in an image instead on mount it and thenuse "find" on it?
  9. where are you get FLASHDRIVE.IMG ?
  10. very good tool. used this a lot to recover files in my computer forensics class. thanks for this tutorial