search

sleuthkit / scalpel

Scalpel is an open source data carving tool. It is not being actively maintained.
627 stars 99 forks source link

Some of the files recovered may be corrupted or have incomplete data #43

Closed Ricky-Tigg closed 11 months ago

Ricky-Tigg commented 4 years ago

Component: scalpel.x86_64 2.1-0.rc1.2.47815c2.fc32.8 @fedora

Case: files deleted today on Fedora from an external drive formatted in FAT32, by invoking shift + del. Location on my system of the default configuration file:

$ rpm -ql scalpel | grep '.conf'
/etc/scalpel.conf

Recovering operation allowed command scalpel -c /home/yk/scalpel.conf -o /home/yk/P.../ /dev/sdb1.

Some the recovered PDF files encounter this issue while attempting to open them:

scalpel_recovered_PDF_document

Strangely some files deleted one year ago could be recovered properly as they were readable but not the last deleted. I am fully ready to investigate by my own in order to recover that last one. I guess I would need knowledge that you would provide if you wish it.

Ricky-Tigg commented 11 months ago

Closing reports of mine on this platform that remain open indefinitely in undone/unfixed states soon, rather than continuing to keep them in such states, which would not be healthy for the project owner.