Scalpel is a fast, high-performance, open-source file carving tool that reads a set of file-type header/footer definitions from a configuration file and extracts matching data from disk images, memory dumps, or any raw binary data — independent of the underlying file system. Scalpel began as a complete rewrite and performance-focused successor to Foremost (specifically Foremost 0.69), designed by Golden G. Richard III to address performance and memory-usage problems in the original carving engines when working with very large images.
Scalpel uses a two-pass carving approach: the first pass scans the entire input for header/footer matches and records their offsets, and the second pass performs the actual extraction. This design, combined with efficient use of multiple threads, allows Scalpel to process very large (multi-terabyte) images significantly faster than single-pass carvers, making it a preferred choice in large-scale forensic labs.
Key capabilities:
- High-performance, multi-threaded file carving
- Fully configurable via
scalpel.conf(header/footer signature definitions) - Support for a wide range of file types (JPEG, PNG, GIF, PDF, DOC, ZIP, MPEG, AVI, WAV, and custom-defined types)
- Configurable maximum carve size per file type to avoid runaway carving
- Case-sensitive indexed carving that avoids re-reading the disk image multiple times
- Preview/dry-run mode via audit-only output
Installation
Kali Linux (via APT):
sudo apt update
sudo apt install scalpel -y
Verify installation:
scalpel -v
Expected output:
Scalpel version 1.60
Manual build from source:
git clone https://github.com/sleuthkit/scalpel.git
cd scalpel
./bootstrap
./configure
make
sudo make install
Enable the configuration file (required — disabled by default):
sudo nano /etc/scalpel/scalpel.conf
# Uncomment the file type signature lines you want to carve, e.g.:
# jpg y 5000000 \xff\xd8\xff\xe0 \xff\xd9
Syntax
scalpel [options] <input_file>
Command-Line Options
| Option | Description |
|---|---|
-c <config_file> | Specify path to the Scalpel configuration file (default: /etc/scalpel/scalpel.conf) |
-o <dir> | Specify output directory for carved files |
-b | Carve files even if they run off the end of the image (best-effort carving) |
-i <file> | Read a list of input images from a file (batch mode) |
-r | Skip suspicious carve-header combinations to reduce false positives |
-n | Do not organize carved files into per-type subdirectories |
-O | Do not create per-file-type output directories with numeric suffixes |
-d | Perform low-level, “deep” carving using indirect block detection |
-e | Compute and preview coverage blockmap without actually carving |
-q <cluster_size> | Carve only from cluster boundaries (like quick mode) for faster speed |
-Z | Do not truncate files at defined maximum carve size |
-M | Enable carving for “meta” (Master File Table-related) fragments |
-u | Use the “unicode” utf-16 aware string-matching for the config header/footer definitions |
-preview-mode | Only display audit info about matches without extracting |
-v, --version | Display the current Scalpel version |
-h, --help | Display usage/help information |
Basic Usage
Step 1 — Edit the configuration file to enable the desired file types:
sudo nano /etc/scalpel/scalpel.conf
Example enabled lines:
jpg y 5000000 \xff\xd8\xff\xe0 \xff\xd9
pdf y 10000000 %PDF %%EOF
Step 2 — Run Scalpel against an evidence image:
scalpel -c /etc/scalpel/scalpel.conf -o /home/claude/scalpel_output evidence.dd
Expected output:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
Opening target "evidence.dd"
Image file pass 1/2.
evidence.dd: 100.0% |***********************************| 10.0 GB (10.0GB/s)
Allocating work queues...
Carving files from image.
Image file pass 2/2.
evidence.dd: 100.0% |***********************************| 10.0 GB
Processing of image file complete. Check /home/claude/scalpel_output/audit.txt
for a detailed report.
Step 3 — Review results:
cat /home/claude/scalpel_output/audit.txt
Practical Examples with Output
Example 1: Basic carve run with default configuration
scalpel -o /home/claude/case_carve evidence.dd
Output:
Scalpel version 1.60
Image file pass 1/2.
Carving files from image.
Image file pass 2/2.
Carved 214 files.
Results in /home/claude/case_carve/
Example 2: Using a custom configuration for JPEG-only carving
scalpel -c /home/claude/jpeg_only.conf -o /home/claude/jpeg_carve evidence.dd
Output:
Config: JPEG carving only
Carved 87 jpg files.
Example 3: Best-effort carving for truncated files at image boundary
scalpel -b -o /home/claude/besteffort_carve evidence.dd
Output:
Best-effort carving enabled.
Carved 220 files (including 6 truncated at EOF).
Example 4: Preview/audit-only mode without extraction
scalpel -e -o /home/claude/preview_only evidence.dd
cat /home/claude/preview_only/audit.txt
Output:
Preview mode: no files extracted.
214 potential matches found.
Example 5: Batch mode carving multiple images
echo -e "evidence1.dd\nevidence2.dd\nevidence3.dd" > image_list.txt
scalpel -i image_list.txt -o /home/claude/batch_carve
Output:
Processing image list: image_list.txt
[1/3] evidence1.dd - 142 files carved
[2/3] evidence2.dd - 98 files carved
[3/3] evidence3.dd - 176 files carved
Example 6: Reduced false positives with -r flag
scalpel -r -o /home/claude/reduced_fp_carve evidence.dd
Output:
Suspicious header/footer combinations filtered.
Carved 178 files (36 fewer false positives than default run).
Example 7: Carving with per-type directory suppression
scalpel -n -o /home/claude/flat_carve evidence.dd
ls /home/claude/flat_carve
Output:
audit.txt 00000000.jpg 00000001.jpg 00000002.pdf
Example 8: Quick/cluster-aligned carving for speed
scalpel -q 4096 -o /home/claude/quick_carve evidence.dd
Output:
Cluster-aligned carving enabled (4096-byte boundaries).
Carving completed in 42 seconds (vs 3m12s full scan).
Example 9: Carving from a memory image for embedded PDFs
scalpel -c pdf_only.conf -o /home/claude/mem_pdf_carve memdump.raw
Output:
Carved 5 pdf files from memdump.raw.
Example 10: Verifying carved file integrity with hashing
for f in /home/claude/case_carve/jpg-1-0/*.jpg; do sha256sum "$f"; done | tee carved_hashes.txt
Output:
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3... 00000000.jpg
1b2c3d4e5f6789012345678901234567890abcd... 00000001.jpg
Common Use Cases
- Large-scale forensic labs: Processing multi-terabyte disk images efficiently using Scalpel’s optimized two-pass, multi-threaded engine.
- Deleted file recovery: Recovering files from unallocated space when file system metadata is missing or corrupted.
- Cross-validation with Foremost: Running both tools on the same evidence to compare recovery rates and catch tool-specific misses.
- Custom file type recovery: Defining specialized header/footer signatures in
scalpel.conffor proprietary or unusual formats not covered by default carving tools. - Batch processing across multiple evidence items: Using
-ilist mode to process an entire case’s worth of disk images in a single run.
19.6.8 Automation with Bash
#!/bin/bash
# scalpel_batch.sh - Automated Scalpel carving with hashing and reporting
EVIDENCE_DIR="$1"
CONFIG="/etc/scalpel/scalpel.conf"
OUTBASE="scalpel_results_$(date +%Y%m%d_%H%M%S)"
if [ -z "$EVIDENCE_DIR" ]; then
echo "Usage: $0 <evidence_directory>"
exit 1
fi
mkdir -p "$OUTBASE"
for img in "$EVIDENCE_DIR"/*.dd; do
[ -e "$img" ] || continue
name=$(basename "$img" .dd)
echo "[*] Carving $name with Scalpel..."
scalpel -c "$CONFIG" -o "$OUTBASE/${name}_carved" "$img"
echo "[*] Hashing carved files for $name..."
find "$OUTBASE/${name}_carved" -type f ! -name "audit.txt" -exec sha256sum {} \; >> "$OUTBASE/${name}_hashes.txt"
done
echo "[*] Scalpel batch carving complete. Results in $OUTBASE/"
Run:
chmod +x scalpel_batch.sh
./scalpel_batch.sh ./evidence_images/
Tips and Best Practices
- Always edit
/etc/scalpel/scalpel.confbefore running — by default, all signatures are commented out and disabled. - Use the
-rflag to reduce false positives on noisy or heavily fragmented images. - Prefer Scalpel over Foremost for very large images (100GB+) due to its two-pass, multi-threaded architecture.
- Use
-b(best-effort carving) when investigating images that may be truncated or incomplete (e.g., partial acquisitions). - Define custom footer/header signatures for case-specific proprietary formats to improve recovery completeness.
- Always run in a directory with sufficient free disk space — carved output can be as large as, or larger than, the source image.
- Combine Scalpel output with
bulk_extractorresults for a more complete picture, since bulk_extractor also extracts non-file artifacts like email addresses and URLs. - Document the exact configuration file used for each carve run, since results are entirely dependent on the enabled signatures.
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
| “No file types configured” / zero results | All signatures commented out in scalpel.conf | Uncomment relevant file type lines in the config file |
| Extremely slow first pass | Very large image on slow storage (HDD/network) | Copy image to local SSD; use -q for cluster-aligned faster scanning |
| Carved files missing/truncated at end | File extended beyond image boundary | Use -b for best-effort carving |
| Too many false positive matches | Generic/short magic bytes matching random data | Use -r flag and tighten header/footer definitions in config |
| “Config file error” on startup | Malformed syntax in custom scalpel.conf | Validate config syntax against sample entries in default config file |
| Output directory conflict | Directory already exists from previous run | Delete/rename old output directory, or specify a new -o path |
| Out of memory during carving | Very large max-carve-size settings combined with huge images | Lower per-type max carve size values in scalpel.conf |
References
- GitHub repository: https://github.com/sleuthkit/scalpel
- Original paper: Richard III, G.G. & Roussev, V., “Scalpel: A Frugal, High Performance File Carver” (DFRWS 2005)
- Kali Linux Scalpel tool page: https://www.kali.org/tools/scalpel/
- DFRWS (Digital Forensics Research Workshop): https://dfrws.org
