LSU Researchers Release Scalpel3 to Recover Fragmented Digital Evidence

Researchers at Louisiana State University (LSU) have released Scalpel3, an open-source digital-forensics tool designed to reconstruct files whose data has been fragmented across storage devices.

The tool addresses a longstanding problem in file carving. While conventional carving can recover files when their data is stored contiguously, fragmented files can be much harder to reconstruct because their pieces may be scattered across a drive.

According to LSU, Scalpel3 successfully reconstructed every fragmented file in the 2006 and 2007 DFRWS digital-forensics grand challenges, solving challenges that had remained unresolved for nearly two decades.

Scalpel3 uses a massively parallel architecture that analyses the internal structure of file formats to narrow the possible arrangements of fragments. Its integrated MoDiCo machine-learning model can classify fragments across as many as 619 file types.

The tool currently supports recovery of images, executable files, audio, archives and modern Microsoft Office documents, with additional formats under development.

The project has also received a $750,000 award from the U.S. National Security Agency (NSA) for continued development.

More than 200,000 lines of Scalpel3 code have been released under an open-source license, allowing forensic researchers and practitioners to examine, test and build on the technology.

The development could give investigators a new option for recovering fragmented evidence from deleted, wiped or damaged storage media.