Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
pendrive.img
device.img
.git
recovery
7 changes: 7 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,10 @@
*.a

src/libscalpel_test

# Images
pendrive.img
device.img
recovery

image-recovery/
28 changes: 28 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
FROM ubuntu:24.04

RUN apt update && \
apt install -y -qq --no-install-recommends \
automake \
autoconf \
default-jdk \
gcc \
g++ \
libtool \
libtre-dev \
libtre5 \
make \
tre-agrep \
unzip && \
rm -rf /var/lib/apt/lists/*

COPY . /scalpel
WORKDIR /scalpel

# Build and compile
RUN ./bootstrap && ./configure --disable-shared && make

# Give execution permission to entrypoint script
RUN chmod 777 /scalpel/entrypoint.sh

# Where/how to start the Docker image
ENTRYPOINT ["/scalpel/entrypoint.sh"]
33 changes: 33 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,39 @@ working directory.
scalpel -c scalpel.conf -o outDirName img-file
```

## Docker

In this section we'll cover how to build and run Scalpel with Docker

### Building the image

To build the image, run the following:

* Run `docker build -t sleuthkit/scalpel .`

### Make a directory to have your images and files recovered

* `mkdir -p image-recovery/disks_images`
* `mkdir image-recovery/files_recovered`

### Run the container

```bash
docker run --rm -it \
-v $(pwd)/image-recovery/device.img:/scalpel/device.img \
-v $(pwd)/files_recovered:/scalpel/recovery \
sleuthkit/scalpel
```

#### Volumes description

There are two docker volumes that you need to mount to recover any files from
the `device.img`.

* `/scalpel/device.img` - this has to be the image file of the device you want
to recovery data from.
* `/recovery` - this is the place where any recovered files will be written.

## OTHER SUPPORTED PLATFORMS

We are not currently supporting Scalpel on Unix variants other than
Expand Down
31 changes: 31 additions & 0 deletions entrypoint.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
#!/usr/bin/env bash

ERRORS=()
PWD=/scalpel

if [[ ! -f ${PWD}/device.img ]]; then
ERRORS+=("No ${PWD}/device.img file available!")
elif [[ ! -d ${PWD}/recovery ]]; then
ERRORS+=("No ${PWD}/recovery directory available!")
fi

function print_errors() {
# echo Num of array items "${#ERRORS[@]}"
if [[ ${#ERRORS[*]} -gt 0 ]]; then
echo "There are ${#ERRORS[@]} errors:"
for item in "${ERRORS[@]}"; do
echo "- $item"
done
return 1
fi
return 0
}

print_errors || exit 1

if [[ $# -gt 0 ]]; then
eval "$@"
else
./scalpel -o ${PWD}/recovery ${PWD}/device.img
fi

30 changes: 30 additions & 0 deletions run.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env bash

ERRORS=()
PWD=$(pwd)

if [[ ! -f ${PWD}/device.img ]]; then
ERRORS+=("No ${PWD}/device.img file available!")
elif [[ ! -d ${PWD}/recovery ]]; then
ERRORS+=("No ${PWD}/recovery directory available!")
fi

function print_errors() {
# echo Num of array items "${#ERRORS[@]}"
if [[ ${#ERRORS[*]} -gt 0 ]]; then
echo "There are ${#ERRORS[@]} errors:"
for item in "${ERRORS[@]}"; do
echo "- $item"
done
return 1
fi
return 0
}

print_errors || exit 1

docker run --rm -it \
-v ${PWD}/device.img:/scalpel/device.img \
-v ${PWD}/recovery:/scalpel/recovery \
sleuthkit/scalpel $@