# Filecarving with scalpel

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FyghZkOmnOPLlHvRYBTBL%2Ffilecarving.jpg?alt=media\&token=14d3cfb1-85cd-42ba-a7e7-99dd4dd76a2c)

### 1. Introduction

In this lab, a disk image file “evidence.img” is provided in the home directory of the root user (/root/). One of the PDF files present on the disk contains the flag.

Extract files from the given image using [**Scalpel** ](https://github.com/sleuthkit/scalpel)tool and retrieve the flag!

Guidelines:

* pdftotext tool can be used to convert PDF files into text files.

### 2. Filecarving with scalpel

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FJ24jpvuWqjXuslXubsyF%2Fscalpel1.png?alt=media&#x26;token=c1dac099-d48b-4f73-b593-517808922221" alt=""></div>

`scalpel evidence.img -o output`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F4dF7B7PUqUVjzpF85Qah%2Fscalpel2.png?alt=media&#x26;token=1036e1f3-5e44-4a9b-a07d-2a1b79196eeb" alt=""></div>

Seems that I’ve to edit the config file first which is located under /etc/scalpel/scalpel.conf

`vi /etc/scalpel/scalpel.conf`

We search for pdf files therefore, I’ll „uncomment“ the lines which are responsible for pdf files

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FGSp2Rl206yB8mCMqD1lR%2Fscalpel3.png?alt=media&#x26;token=1e3e3227-75a1-4070-9f51-285ff7e00299" alt=""></div>

Save the file and give scalpel a new try:

`scalpel evidence.img -o output`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FjmpGISAaaXZ9KgZ63wgP%2Fscalpel4.png?alt=media&#x26;token=19e5466a-2084-4fad-86a1-25674b14341b" alt=""></div>

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FETBmuUEMXyUi9nIi46Li%2Fscalpel5.png?alt=media&#x26;token=e73d2e49-88d0-499c-9f06-b5707dac0312" alt=""></div>

### 3. Retrieve the flag

Let's browse to the output directory and use pdf to text to reveal the flag

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F835CPwWWRRjHRBRjG4dJ%2Fscalpel6.png?alt=media&#x26;token=ebb33ef7-e016-492a-aa95-4d1efef2cf42" alt=""></div>

### &#x20;4. Summary

{% embed url="<https://vimeo.com/676632878>" %}