Skip to content

Scalpel on OSX

This is a brief tutorial for the use and installation of Scalpel on OSX

  • The first thing to do is to download the TRE (regex) library (here)
  • open your download folder via a terminal and type in :

  • Once the TRE library installed download scalpel (here)
  • Type in the following commands : 

And that’s it, Scalpel should be installed.
Now that scalpel has been installed, open the “scalpel.conf” file and edit the lines of the type of files you want to recover.
For example, delete the comment  ‘#’  before each type of file you want to recover.
Finally  to use it against a usb drive, enter the following line :

Note : scalpel might be installed in :
In which case you will have to copy the executable back to the folder that contains “scalpel.conf”  (in my case)

 

In this case the following options are used :
  •  -v for verbose
  • -o  for the directory to place the recovered files 
  • and finally the path to the USB drive 
And that’s how you can use scalpel
By the way, a last tip :  To list the partitions you can use the following command on Mac OSX.

OsX Sierra

 

If you are using Mac OsX Sierra,  please follow these steps.
  1. Install mac port
  2. Follow these instructions

 

make sure you choose automake rather than automake17

Followed by these instructions

Thank you @Lynsay  for clarifying this on her blog.

Post a Comment

Your email is never published nor shared. Required fields are marked *