Skip to content

Commit 7dbce89

Browse files
committed
Added markdown syntax and update to readme, fixed scalpel.conf errors
1 parent 4364309 commit 7dbce89

2 files changed

Lines changed: 64 additions & 22 deletions

File tree

README renamed to README.md

Lines changed: 62 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
********************************************************************
1+
# README
22

33
As of 6/27/2013 Scalpel has been released under the Apache 2.0 License
44
and the source is available at The Sleuth Kit github repository.
@@ -10,7 +10,23 @@ into several memory leaks and the effort was abandoned.
1010
No official releases are being made. You can submit pull requests,
1111
but they may take a while to get reviewed.
1212

13-
********************************************************************
13+
## Fork update
14+
15+
Since the main repo is not being maintained and there are a couple of pull
16+
requests, I decided to fork the main repo and start to include some of the
17+
pull requests in here. If anyone wants to add pull requests, I'll be ready
18+
to review, test and merge them.
19+
20+
I'll be updating the repo as well as I keep finding fixes.
21+
22+
I haven't found a straight foward way to compile the program in Linux as of
23+
Feb/4/2025. I have to read the code and keep adding the exact way to do it
24+
to the README. Any help is welcome.
25+
26+
Of course, I've this is not my initial work, thus I've included the Apache 2
27+
license as stated by sleuthkit main repo.
28+
29+
## Information
1430

1531
Scalpel is a file carving and indexing application that runs on Linux
1632
and Windows. The first version of Scalpel, released in 2005, was
@@ -73,27 +89,59 @@ that our compilation environment for Windows is currently 32-bit; we
7389
haven't tested on the 64-bit version of mingw, but will address this
7490
int the future.
7591

76-
COMPILE INSTRUCTIONS ON SUPPORTED PLATFORMS:
92+
## Requirements for Linux
93+
94+
- libtool
95+
- automake
96+
- autoconf
97+
- make
98+
- tre-agrep
99+
- libtre5
100+
- libtre-dev
101+
102+
### Install dependencies
103+
104+
> I added gcc and g++ just in case
105+
106+
```bash
107+
sudo apt install automake autoconf libtool make tre-agrep libtre5 libtre-dev gcc g++ -y
108+
```
77109

78-
Linux/Mac OS X:
79-
% ./bootstrap
80-
% ./configure
81-
% make
110+
## Compiling
82111

83-
Windows (mingw):
112+
```bash
113+
# Linux/Mac OS X:
114+
./bootstrap
115+
./configure
116+
make
117+
```
118+
119+
```bash
120+
# Windows (mingw):
84121
cd src
85122
mingw32-make -f Makefile.win
123+
```
86124

125+
## Installing
87126

88-
and enjoy. If you want to install the binary and man page in a more
127+
If you want to install the binary and man page in a more
89128
permanent place, just copy "scalpel" (or "scalpel.exe") and
90129
"scalpel.1" to appropriate locations, e.g., on Linux, "/usr/local/bin"
91130
and "/usr/local/man/man1", respectively. On Windows, you'll also need
92131
to copy the pthreads and tre regular expression library dlls into the
93132
same directory as "scalpel.exe".
94133

134+
## Running
135+
136+
To run Scalpel, the file `scalpel.conf` must be specified in the current
137+
working directory.
138+
139+
```bash
140+
# Folder has to exists
141+
scalpel -c scalpel.conf -o outDirName img-file
142+
```
95143

96-
OTHER SUPPORTED PLATFORMS
144+
## OTHER SUPPORTED PLATFORMS
97145

98146
We are not currently supporting Scalpel on Unix variants other than
99147
Linux. Go ahead and try a ./configure and make and see what happens,
@@ -104,10 +152,10 @@ supporting a GPU-enhanced version of Scalpel on Windows, we are also
104152
interesting in hearing from you.
105153

106154

107-
LIMITATIONS:
155+
## LIMITATIONS
108156

109-
Carving Windows physical and logical device files (e.g.,
110-
\\.\physicaldrive0 or \\.\c:) isn't currently supported because it
157+
Carving Windows physical and logical device files `(e.g.,
158+
\\.\physicaldrive0 or \\.\c:)` isn't currently supported because it
111159
requires us to rewrite some portions of Scalpel to use Windows file
112160
I/O functions rather than standard Unix calls. This may be supported
113161
in a future release.
@@ -119,7 +167,7 @@ The -s command line option ("skip") has been removed and will be
119167
replaced with a more robust facility in the next major release.
120168

121169

122-
DEPENDENCIES:
170+
## DEPENDENCIES
123171

124172
Scalpel uses the POSIX threads library. On Win32, Scalpel is
125173
distributed with the Pthreads-win32 - POSIX Threads Library for Win32,
@@ -133,9 +181,3 @@ Cheers,
133181

134182
--Golden and Vico.
135183

136-
137-
138-
139-
140-
141-

scalpel.conf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,8 +172,8 @@
172172
# wma y 8000000 \x30\x26\xB2\x75 \x52\x9A\x12\x46
173173
#
174174
# MP3
175-
# mp3 y 8000000 \xFF\xFB??\x44\x00\x00
176-
# mp3 y 8000000 \x57\x41\x56\45 \x00\x00\xFF\
175+
# mp3 y 8000000 \xFF\xFB?\x44\x00\x00
176+
# mp3 y 8000000 \x57\x41\x56\x45 \x00\x00\xFF\
177177
# mp3 y 8000000 \xFF\xFB\xD0\ \xD1\x35\x51\xCC\
178178
# mp3 y 8000000 \x49\x44\x33\
179179
# mp3 y 8000000 \x4C\x41\x4D\x45\

0 commit comments

Comments
 (0)