Security Blue Team Level 1 Practice Test

In forensic imaging, file carving recovers files from raw data by scanning for known file signatures (headers and footers) rather than relying on how the file is stored in a filesystem. Scalpel is built specifically for this purpose: it uses a configuration of file type signatures to search through the image or unallocated space and extract continuous data blocks as individual files, outputting them for review. While other tools can perform carving as part of broader forensic workflows, Scalpel focuses on the carving process itself and supports many formats, making it the most direct and flexible choice for this task.