Wednesday, May 11, 2011

Scalpel 2.0 is here with lots of new features

Scalpel file carver, version 2.0 - has the first public release in almost five years. There are a slew of performance enhancements and new features, focusing on improved carving accuracy and performance, and even more goodness is on the

Just some of the new features include:

  • Support for TRE-based regular expressions for headers and footers
  • Support for minimum carve sizes for recovered files
  • Parallel architecture to take full advantage of multicore processors
  • Beta support for NVIDIA CUDA-based GPU acceleration of header / footer searches
  • An asynchronous IO architecture for significantly faster IO throughput
  • Support for 32 and 64-bit Linux, Windows XP, Vista and 7, and OSX

In the coming weeks will post some ways to put these new features to
good use, as well as for the introduction of some even newer

The new version can be downloaded from:
The download file contains pre-compiled Windows binaries as well as the project
source code.  If you find any bugs while using Scalpel please send an
email to scalpel at digitalforensicssolutions dot com. If you want to send
comments to the authors, you can  contact Golden Richard
( / @nolaforensix ) or Lodovico Marziale ( / ).
If you are interested in the GPU research that went into this project, read the published paper at DFRWS that discusses both the CUDA architecture as well as
the integration of it into Scalpel. It can be found here