Filecarving with scalpel
Last updated
Last updated
In this lab, a disk image file “evidence.img” is provided in the home directory of the root user (/root/). One of the PDF files present on the disk contains the flag.
Extract files from the given image using Scalpel tool and retrieve the flag!
Guidelines:
pdftotext tool can be used to convert PDF files into text files.
scalpel evidence.img -o output
Seems that I’ve to edit the config file first which is located under /etc/scalpel/scalpel.conf
vi /etc/scalpel/scalpel.conf
We search for pdf files therefore, I’ll „uncomment“ the lines which are responsible for pdf files
Save the file and give scalpel a new try:
scalpel evidence.img -o output
Let's browse to the output directory and use pdf to text to reveal the flag