Foremost / Scalpel — authorized header-footer file carving
Foremost and Scalpel are classic header/footer file carvers. Cite Foremost 1.5.7 and Scalpel 1.60 (packaged) / 2.02 (multithreaded source). Use only on images you are authorized to examine.
Snapshot
| Field | Value |
|---|---|
| Foremost | Commonly 1.5.7 upstream |
| Scalpel | 1.60 widely packaged; 2.02 multithreaded source on nolaforensix |
| Job | Header/footer carving from disk images |
| Peers | bulk_extractor, binwalk |
Allowed framing
- Recovering known file types from lab-owned or warrant-authorized images.
- Teaching conf-file header/footer patterns in DFIR courses.
- Comparing carve sets across Foremost vs Scalpel on the same authorized image.
Scope we will not cover
- No unauthorized imaging of third-party drives.
- No “defeat encryption by carving” myths presented as fact.
- No exploit PoCs built from carved payloads.
Beginner path (authorized only)
- Work on a read-only copy of an authorized image in a disposable VM.
- Start with a small conf (few file types) before enabling large carve sets.
- Record tool version (Foremost 1.5.7 vs Scalpel 1.60 vs 2.02) beside image hashes.
- Validate carved files with format checkers — header matches are not proof of integrity.
- For feature histograms rather than file recovery, consider bulk_extractor.
- Use Foremost/Scalpel for classic file carving on authorized images.
- Prefer bulk_extractor for broad feature extraction and binwalk for firmware.
- Refuse unauthorized acquisition framing.
For legal, authorized and educational use only.
FAQ
What are Foremost and Scalpel?
Both are filesystem-independent file carvers that recover files by matching configured headers/footers (and size constraints) in a disk image or raw device dump — useful when directory metadata is gone.
Which versions are cited?
Foremost upstream is commonly 1.5.7. Scalpel 1.60 remains the widely packaged line (Debian still ships 1.60-based builds); Scalpel 2.02 source is published at nolaforensix/scalpel-2.02 as a multithreaded improved release (checked 2026-10-24). Pin the exact tree your lab runs.
What licenses apply?
Historically GPL-family for these carvers (Scalpel 2.02 README states GPL). Confirm the LICENSE file in the exact tarball you build.
bulk_extractor/binwalk or Foremost/Scalpel?
Prefer bulk_extractor for broad feature scanning and binwalk for firmware/embedded signatures. Prefer Foremost/Scalpel when you specifically need classic header/footer carving configs on authorized images.
Does this teach unauthorized recovery of someone else's deleted files?
No. Authorized DFIR, incident response under mandate, and education only — BinBench will not supply unauthorized acquisition recipes.