Scalpel

[Sashank999]

Hi !

My request is to add Scalpel to the x86_64 TC v11 repo.

Thanks in advance.

[Juanito]

You've submitted many extensions to the repo (thanks) - why not this one?

[Sashank999]

A tragedy happened ...

I was actually testing a script that would separate the .h, .la, .a, etc. -dev files and man pages into -doc as separate tczs from a given tce (my laziness led me). In the clean up process of the script I included "rm -rf "$FILE"/*" and accidentally ran it without any args.

And guess what... my whole sda5 partition containing TC x64 (with a lot of tczs), my data backup(along with the bloody script that caused this destruction and my favourite developing submitqc patch)  and dCore x64(only kernel and initrd, NP) was gone into ashes  . Thank God I did not mount my Windows 10 or Phoenix OS. To recover sda5, I need Scalpel.

[Juanito]

scalpel posted

[Sashank999]

Hi !

Sorry for the late reply but :
1. The tcz doesn't have a base config file. The file at https://github.com/sleuthkit/scalpel/blob/master/scalpel.conf should be included in the base tcz
2. It gets a segmentation fault exactly at 4.2% of recovery of my ext4 partition. I don't know why. Can anyone help me ?

[Juanito]

Where does it look for scalpel.conf - /usr/local/etc, /usr/local/etc/scalpel or ?

[Sashank999]

I tested keeping it in those both locations but it doesn't consider them. It looks for conf in current location. Even the man page says that. So, we should keep it in ~.

Do you know anything about "Segmentation Fault" error ?

[Rich]

Hi Sashank999
Segmentation Fault  means the program tried to access a memory location that does not exist. Was that the entire
error message? If you include the  -v  parameter when running the program, does it provide any useful information?

[Juanito]

scalpel.conf added and extension reposted

[Sashank999]

Hi Rich, Juanito !

The -v option took it upto 10.1% but still the same error. Output redirected via a pipe to output file via tee command. I replaced lines containing "A tcz footer was found at : (Disk address)" lines with letters "TL" to reduce its size from 10MB to 0.9MB. Here : https://safenote.co/r/5f67729a47ea99@12613152

Thanks for reposting Juanito.