scalpel - Fast file carver
Scalpel is a fast file carver that reads a database of header and footer
definitions and extracts matching files from a set of image files or
raw device files. Scalpel is filesystem-independent and will carve
files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both
digital forensics investigation and file recovery. Scalpel resulted from
a complete rewrite of foremost 0.69, a popular open source file carver,
to enhance performance and decrease memory usage.
Public release, with multithreading, asynchronous I/O, regular expression
support, minimum carve sizes. Blockmap features are currently
removed, since they are being rewritten. We have also deprecated
the -s option, since it is broken. A new skip option based on
blockmaps will be introduced in the next major release and will
allow specific areas of disk images to be targeted for carving.