Scalpel

Scalpel is a free, open-source file carving tool for digital forensics, originally written by Golden G. Richard III as a faster rewrite of Foremost. It recovers deleted files from disk images, drives and unallocated space by searching the raw data for file headers and footers, without relying on the file system.

Investigators control what Scalpel carves through its configuration file, scalpel.conf, where each file type is enabled and defined by its header, footer and maximum size. Scalpel comes preinstalled on Kali Linux and is a common tool in CHFI and forensics training.

Compare it with PhotoRec, Bulk Extractor, Autopsy and X-Ways in our guide to the 7 best data carving tools, and follow our tutorials for hands-on examples.