Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files or data fragments from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, HFS+, or raw partitions. It is useful for both digital forensics investigation and file recovery. To use it, you MUST have a conf file that defines the file types you want to recover. Use the example scalpel.conf file from /usr/doc/scalpel See the man page for details.