search

sleuthkit / scalpel

Scalpel is an open source data carving tool. It is not being actively maintained.
627 stars 99 forks source link

Scalpel can't recover files in partition if it was edited with dd #13

Open vchampion opened 9 years ago

vchampion commented 9 years ago

If some partition was incorrectly edited with dd Scalpel can't recover files from it - it incorrectly obtains size of partition which equals damaged memory size and as expected tries recover files in damaged area despite on the rest of correct memory.

You can reproduce that bug simply - create image with dd, then format it (for example as ext3 drive), fill with files and then make dd if=/dev/zero of=yourdrive.img count=10 bs=1M and then try to restore files..

simsong commented 8 years ago

How are you running Scalpel? Scalpel doesn't know about partition tables. In your example, are you attempting to carve the file yourdrive.img and not finding anything, but you previously found information? Your Issue mentions memory, but the example is restricted to a file yourdrive.img. Can you clarify?