Recovering deleted files with Scalpel

Conclusions

Scalpel cannot replace a backup, but it can come to the rescue in many cases. Do not expect miracles, however; fragmented files or physical storage faults make it difficult to detect file ends and push Scalpel to its limits. In this case, the "rescued" files will often prove to be useless.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Recovering Deleted Files

    Modern filesystems make forensic file recovery much more difficult. Tools like Foremost and Scalpel identify data structures and carve files from a hard disk image.

  • Data Reconstruction

    One false click can quickly delete important data, or even an entire partition. If a backup tool is missing, only a rescue specialist can help.

  • OCFA

    Automate the forensics process with the Dutch police department's Open Computer Forensics Architecture.

  • Perl – Memes

    It started off harmlessly enough with a few funny pictures of cats, but eventually it became the Internet phenomenon par excellence. It's no joke: Perl gives you some great tools for building and customizing memes yourself.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95

News