scalpel crashed when disk is full

[mmokrejs]

Hi,
indeed the error message printed was incorrect and indeed the target drive was full. although it seems the error message cannot be improved the application shout not crash:

# scalpel -o /mnt/foo/scalpel /mnt/foo/dm-3.raw
...
Work queues built.  Workload:
gif with header "\x47\x49\x46\x38\x37\x61" and footer "\x00\x3b" --> 1471 files
gif with header "\x47\x49\x46\x38\x39\x61" and footer "\x00\x00\x3b" --> 33065 files
jpg with header "\xff\xd8\xff\xe0\x00\x10" and footer "\xff\xd9" --> 92280 files
png with header "\x89\x50\x4e\x47\x0d\x0a\x1a\x0a" and footer "\x00\x00\x00\x00\x49\x45\x4e\x44\xae\x42\x60\x82" --> 492546 files
tif with header "\x49\x49\x2a\x00" and footer "" --> 90819 files
tif with header "\x4D\x4D\x00\x2A" and footer "" --> 83839 files
avi with header "RIFF????AVI" and footer "" --> 2131 files
mpg with header "\x00\x00\x01\xba" and footer "\x00\x00\x01\xb9" --> 207682 files
mpg with header "\x00\x00\x01\xb3" and footer "\x00\x00\x01\xb7" --> 169385 files
fws with header "FWS" and footer "" --> 474499 files
wav with header "RIFF????WAVE" and footer "" --> 2440 files
doc with header "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00" and footer "\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00" --> 4349 files
doc with header "\xd0\xcf\x11\xe0\xa1\xb1" and footer "" --> 4616 files
pst with header "\x21\x42\x4e\xa5\x6f\xb5\xa6" and footer "" --> 0 files
ost with header "\x21\x42\x44\x4e" and footer "" --> 556 files
dbx with header "\xcf\xad\x12\xfe\xc5\xfd\x74\x6f" and footer "" --> 14 files
idx with header "\x4a\x4d\x46\x39" and footer "" --> 2563 files
mbx with header "\x4a\x4d\x46\x36" and footer "" --> 2589 files
htm with header "<html" and footer "</html>" --> 100205 files
pdf with header "%PDF" and footer "%EOF\x0d" --> 3855 files
pdf with header "%PDF" and footer "%EOF\x0a" --> 4295 files
zip with header "PK\x03\x04" and footer "\x3c\xac" --> 1363443 files
java with header "\xca\xfe\xba\xbe" and footer "" --> 219551 files
tgz with header "\x1f\x8b\x08\x08" and footer "" --> 20982 files
ogg with header "x4fx67x67x53x00x02" and footer "x4fx67x67x53x00x02" --> 0 files
Carving files from image.
Image file pass 2/2.
/mnt/foo/dm-3.raw:   9.3% |****************                                                                                                                                                                      |  166.2 GB --:--ETA
Error writing to file: /mnt/foo/scalpel/tif-4-7/00626367.tif -- Operation not permitted
Scalpel was unable to write output files and will abort.
This error generally indicates that disk space is exhausted.
Error carving file Scalpel was unable to write output files and will abort.
This error generally indicates that disk space is exhausted.


Opening target "/mnt/foo/dm-3.raw"

Segmentation fault (core dumped)

I added a newline before the Error writing to file message so it appears visible but the \n should be added into the source code. The binary has no debug symbols so the 2GB core dump file was not helpful.

Indeed, next I time I should figure out the config file and enable recovery of only jpg files. The runtime help is too difficult to understand:

# scalpel -h
Scalpel version 2.1
Written by Golden G. Richard III and Lodovico Marziale.
Scalpel carves files or data fragments from a disk image based on a set of
file carving patterns, which include headers, footers, and other information.

Usage: scalpel [-b] [-c <config file>] [-d] [-e] [-h] [-i <file>]
[-n] [-o <outputdir>] [-O] [-p] [-q <clustersize>] [-r]
[-v] [-V] <imgfile> [<imgfile>] ...

Options:
-b  Carve files even if defined footers aren't discovered within
    maximum carve size for file type [foremost 0.69 compat mode].
-c  Choose configuration file.
-d  Generate header/footer database; will bypass certain optimizations
    and discover all footers, so performance suffers.  Doesn't affect
    the set of files carved.  **EXPERIMENTAL**
-e  Do nested header/footer matching, to deal with structured files that may
    contain embedded files of the same type.  Applicable only to
    FORWARD / NEXT patterns.
-h  Print this help message and exit.
-i  Read names of disk images from specified file.  Note that minimal parsing of
    the pathnames is performed and they should be formatted to be compliant C
    strings; e.g., under Windows, backslashes must be properly quoted, etc.
-n  Don't add extensions to extracted files.
-o  Set output directory for carved files.
-O  Don't organize carved files by type. Default is to organize carved files
    into subdirectories.
-p  Perform image file preview; audit log indicates which files
    would have been carved, but no files are actually carved.  Useful for
    indexing file or data fragment locations or supporting in-place file
    carving.
-q  Carve only when header is cluster-aligned.
-r  Find only first of overlapping headers/footers [foremost 0.69 compat mode].
-V  Print copyright information and exit.
-v  Verbose mode.
#