7- Select a directory where you want to save the recovered files and press Enter and Y (yes)

dont use scalpel, just install PhotoRec which is part of TestDisk. You can install it with:

sudo apt-get install testdisk

Then in a terminal type sudo photorec and you follow these steps:

1- Select media (if you’re recovering from an external usb device like a hdd you can run sudo fdisk -l to check the device name. It will usually be /dev/sdb or /dev/sdc)

2- Proceed > Select Intel and Enter

3- Either Search (to search for any files) or choose (File Opt) to select which file types to look for. Press Space to select / deselect and b to save and then Enter

4- Search

5- For files deleted under linux select (ext2/ext3) or under Windows (Other)

6- choose either Free or Whole depending on your needs

7- Select a directory where you want to save the recovered files and press Enter and Y (yes)

8- Be patient and you’ll see a directory called “recup_dir.1″ with all recovered files. You might get several recup_dirs.

The only problem is that files won’t have their names but you can sort them later by type or size or whatever.

Hope this helps!
Cheers

srpayo

add this line to the /etc/scalpel/scalpel.conf:

rtf y 3000000 \x7b\x5c\x72\x74\x66(\x31)

WITHOUT the thing in braces, this is good for scalping rtf, if you want to search for specially rtf version 1 (it’s used nowadays), include the \x31 part too! You can modify the 3000000 to whatever you want, it means the program will make files from the matching point to 3000000 bytes long.

Greets from Hungary,
conoyes

When using this is to uncomment (remove the # in front of) the file types in the config file. To do that, open a terminal and run gksudo gedit /etc/scalpel/scalpel.conf. Then, save the changes and return to the terminal.

To download the scalpel program, remember to add sudo to the command when you type it in to your terminal (sudo apt-get install scalpel).

To run the scalpel command correctly, you must again add sudo to it (sudo scalpel /dev/sda1 -o output). Remember, sda1 is the default name for your computer’s hard drive, so if you have a dual drive setup, or an external drive, verify the correct device name by opening the System Monitor and checking the File Systems tab.

If you’ve previously run scalpel, change “output” to something else, or clean out the contents of the output file before you start the process. If you don’t, you will get an error message regarding trying to work with a “non-empty” directory.

I wrote a simple script that executes the scalpel command. All you need to do is put the file in your bin folder, and create a desktop shortcut for it. If you’d like the script, drop me a PM on the Ubuntu Forum. My name there is tacantara.

[sudo] password for mint:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target “/dev/sda1″

Image file pass 1/2.
/dev/sda1: 2.0% | | 250.0 MB 27:09 ETA** MEMORY ALLOCATION FAILURE **
ERROR: Memory exhausted at line 286 in file dig.c. Scalpel was
allocating memory for header array when this condition occurred.
Scalpel will abort.

here’s what I need:
I was working with GEDit (another heap of crap, that), and it lost a draft piece of writing I had done (because it, or I, got confused when I tried to re-name it. Unbelievable.)
These seem to be suffix-less files, in this case initially on my (Mint) desktop, a good page of prose.
Can I limit the search to the desktop? To GEDit-type files?

So, I wonder if you could tell me in plain English, without assumptions about my (poor)
inside knowledge of Linux, exactly how I might recover my lost draft (without incurring some odd undocumented memory error).

Then perhaps do some decent documentation so I don’t have to be fucked around next time I or anyone else needs to use you no-doubt excellent utility
It is, after all, my time and patience that is wasted.

ANd, meantime, perhaps help my poor fellow sufferers above with what they want to do in the real world.

….Oh, for Christ’s sake, does it have to be like this? I wasn’t expecting to go into the flames….

(hey, you’re talking to non-tech newbies here,
WHO JUST WANT TO RECOVER THEIR DAMNED FILES,
not to technical geniuses, who if they were technical geniuses, would not need this anyway.)

then when I get past all that, it crashes with a ‘run out of memory’ thing, WHAT???
at about 1.7% done.

So, thanks for trying, COULD DO BETTER though.

I’m getting the following message:
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
to maintain forensic soundness, this is not allowed.
Aborting.

and when I check my home folder I do not see the output folder.

Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
to maintain forensic soundness, this is not allowed.
Aborting.

Please help.

“ERROR: The configuration file didn’t specify any file types to carve.
(If you’re using the default configuration file, you’ll have to
uncomment some of the file types.)”

please help, Yes I am a newbie. if there is need to elaborate what I did please let me know,I need those files…

how to solve this dude ?

I had to edit the config file to get it to work:
sudo gedit /etc/scalpel/scalpel.conf