Recover Deleted Files on Linux Using Scalpel

Scalpel is a powerful data recovery tool and an improved version of Foremost 0.69. While Foremost is great for recovering deleted data, it can become CPU-heavy during large recovery tasks. Scalpel solves this issue by offering faster performance and better efficiency .

It comes pre-installed on Kali Linux and is one of the most reliable forensic tools available. Unlike Foremost, which requires specifying file types every time, Scalpel allows you to configure a recovery list once through its configuration file.

Configuring Scalpel on Kali Linux ​

Before running Scalpel, we need to tell it what file types to recover. This can be done by editing the configuration file located at:

sudo mousepad /etc/scalpel/scalpel.conf

When you open this file, you’ll see a list of file types - each line starts with a # symbol, meaning it’s commented out (disabled).

To activate a specific file type (for example, .jpg or .gif), simply remove the # in front of the line. This tells Scalpel to search for and recover that file type .

Example:
If we want to recover JPG and GIF images, just uncomment their lines, save the file (Ctrl+S), and close it.

---

Using Scalpel to Recover Files ​

Once configured, let’s check Scalpel’s available options:

scalpel -h

This will display all possible commands and flags. The options are simple and beginner-friendly .

Now let’s recover deleted files from a USB drive. Imagine we formatted a USB stick containing some images - we’ll use Scalpel to bring them back!

Important: Never run recovery directly on the original disk.
Always create a bit-by-bit clone first (using tools like Guymager) to preserve evidence and data integrity.

Suppose our cloned disk file is named KaliLinuxIn.dd, located on the Desktop. To start the recovery process, use this command:

scalpel -o recovered/ KaliLinuxIn.dd

Here:

• -o specifies the output folder.
• The recovered files will appear inside a new folder named recovered/ on your Desktop.

Once done, you can open the folder and explore your recovered files .
Scalpel also creates an audit.txt file that logs recovery details and results - very useful for forensic analysis.

---

Scalpel vs. Foremost ​

Both Foremost and Scalpel are effective data recovery tools, but each has its strengths:

• Scalpel is faster and handles heavy CPU tasks better.
• Foremost is slightly more accurate but slower.

Neither tool can restore the original filenames, and sometimes files may appear duplicated - this happens when data fragments are recovered separately.

Final Thoughts ​

If you’re doing digital forensics or just want to recover deleted files on Linux, Scalpel is a must-have tool . It’s fast, efficient, and built for professionals and beginners alike.

Try both Scalpel and Foremost, and let us know which one you prefer in the comments .

Want more easy tech tutorials like this?
Follow our GitHub and Twitter for updates, and subscribe to get new articles straight to your inbox