_W_wldu·Nov 29, 2020
Scalpel was made to do this. It works great. Has for years.
https://github.com/sleuthkit/scalpel
In Undeleting a file overwritten with mvsleuthkit
scalpel
Shell2020–2023
sleuthkit / scalpel
scalpel
Scalpel is an open source data carving tool. It is not being actively maintained.
5Distinct people
5Mentions
0Explicit recommenders
691GitHub stars
What to know before exploring
What it is
Scalpel is an open source data carving tool. It is not being actively maintained.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year5 dated mentions
Observed mentions: 2020-05-03 14:41:58 UTC to 2023-07-03 20:19:18 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
What Hacker News says
3 sourcesScalpel, as good as it was back in its time, sadly has been stalled. Carrier and/or the folks in charge of The Sleuth Kit have taken it into their github repo[0] but there haven't been commits for ~7 years now.
I did a thesis on file carving some 10 years ago, and scalpels ideas where very good back then. Photorec[1], however, has been the gold standard for a long time on (open source) file carving. It can handle text based formats way better (scalpel is severely limited in this aspect due to the "header/footer" paradigm), and is a wonder with stream based formats (that can have boundaries on the bit level).
And it's not because they authors weren't good[2], I think what mainly happened is that they didn't have the time to keep maintaining the software they created (I know that has happened to me more than once).
There are also some comme
Read the rest
rcial file carving tools, though most are aimed at having better integration with forensics software (like Encase, FTK, Oxygen, etc) or automate parts of the process, like document analysis. Still, if you just want to compare them by their ability to recover files, I'm pretty sure Photorec makes it to the top.
[0] https://github.com/sleuthkit/scalpel
[1] https://www.cgsecurity.org/wiki/TestDisk_Download (PhotoRec is part of TestDisk)
[2] They're some of the best in the field of digital forensics
> There are specialized tools you can use to analyze this data blob.
These are called file carving tools and two better known ones are foremost and it's successor scalpel [1].
[1] https://github.com/sleuthkit/scalpel
In How I recovered a lost email from my email client’s memory