File Carving with foremost & scalpel

What carving is

File carving ignores the filesystem entirely. It scans raw bytes for signatures — the magic numbers at the start (header) and end (footer) of known file types — and copies everything between them. No metadata, no inode, no directory needed. If the data is there, carving can reach it.

When to carve

• Recovering deleted files whose inodes were already reused.
• Mining unallocated space and slack space.
• Working with damaged filesystems that won't mount at all.
• Finding stray files in swap, pagefiles, or hibernation images.

foremost

apt install foremost        # Debian/Ubuntu
dnf install foremost        # Fedora

# carve everything from an image into a fresh output dir
foremost -i /evidence/part2.dd -o /evidence/carved/

# options
foremost -i img.dd -o out/ -t jpg,png,doc   # limit types
foremost -i img.dd -o out/ -q               # quiet, faster
foremost -i img.dd -o out/ -v               # verbose
foremost -i img.dd -o out/ -d               # detect blocks skipped by table

# results land in out/audit.txt + per-type folders
ls /evidence/carved/
  audit.txt  jpg/  pdf/  png/

scalpel & its config

Scalpel is faster and fully config-driven. Its config lists every file type's header/footer signature:

apt install scalpel

# inspect the default config
vim /etc/scalpel/scalpel.conf
  # uncomment lines to enable types, e.g.:
  jpg     y       2000000   \xff\xd8\xff      \xff\xd9
  png     y       500000    \x89\x50\x4e\x47  \x00\x00\x00\x00

scalpel -i /evidence/part2.dd -o /evidence/scalped/ -c /etc/scalpel/scalpel.conf

Format: extension case size header footer. The size is a max bound; headers and footers are hex escapes.

Adding custom file types

Linux forensic work often needs types not in the defaults:

# add to scalpel.conf: ELF binaries + sqlite databases
elf     y       2000000   \x7f\x45\x4c\x46       \xff\xff\xff\xff
sqlite  y       50000000  \x53\x51\x4c\x69\x74\x65  \x00\x00\x00\x00

# find magic bytes for anything with xxd:
xxd -l 32 /path/to/example.db

Reviewing results

Always sanity-check carved output before trusting it:

# confirm each file's real type matches the folder it landed in
cd /evidence/carved/jpg
for f in *; do file "$f"; done | sort | uniq -c | sort -rn | head

# check for zero-size or truncated files
find /evidence/carved -type f -size 0 -delete
find /evidence/carved -type f -size -1k -ls

# hash the interesting recoveries for your report
sha256sum /evidence/carved/pdf/*

← Previous: dd & dcfldd  ·  Next: strings & grep →