LSU Research Bites: Breakthrough File Recovery System Rebuilds Lost Data From Damaged or Fragmented Devices
November 14, 2025
An unauthorized drone crashes and its onboard storage devices are damaged beyond repair. No cybersecurity tools exist that can recover the fragmented data from such a device… until now.
When files are deleted or a storage device is damaged, such as when a criminal tries to delete incriminating evidence from a computer’s hard drive before throwing it in a dumpster, the data aren’t always truly gone.
Digital forensics experts often use “file carving” tools that sift through raw data left behind and look for file signatures (specific sequences of bytes) that mark the beginning and end of a file. These tools can extract and reassemble the remaining data of detected files.
Because carving tools are not concerned with filenames or locations, they can reconstruct files that were deleted, hidden, renamed, or relocated on a device.
But existing carving tools have one major limitation. They can generally recover only raw data available in a single, continuous block, or in some specialized cases, a limited number of fragments. If the data are truly fragmented, traditional carving fails. This is a major limitation for cybersecurity experts who could answer many more questions about security incidents if they could reconstruct fragmented data.
Five years ago, Golden George Richard III, Professor of Computer Science and Engineering and Director of the LSU Cyber Center and Applied Cybersecurity Lab, decided to tackle what others thought was impossible: developing a tool for efficient recovery of fragmented data.
There are no existing tools except for Scalpel3 that might be employed to attempt to recover the fragmentary data on a device, so its origin and function can be investigated.
Golden George Richard III, Professor of Computer Science and Engineering and Director of the LSU Cyber Center and Applied Cybersecurity Lab
As the original author of Scalpel, one of the original and most widely used data-carving tools in digital forensics, Richard set out to build its modern successor. After a significant research and development effort, he has created a carving framework named Scalpel3, designed explicitly to support both contiguous and fragmented file recovery at scale. Scalpel3 can rebuild files that have been scattered across a damaged drive. It integrates dozens of intelligent heuristics to accelerate the recovery process and is the first open-source platform for developing advanced techniques for reconstructing fragmented data.
Scalpel3 works like an expert, assembling puzzle pieces by utilizing matching algorithms and aligning small, overlapping pieces of data in a manner similar to how DNA sequencing works.
Scalpel3 could transform digital forensics, enabling more rapid and accurate resolution of cybercriminal investigations. It would improve national security and enable data recovery after natural disasters. On the flipside, it could help cybersecurity experts create more secure systems for truly erasing sensitive data, for example.
Richard's lab is currently in the process of submitting several peer-reviewed research papers on this toolchain. The work has involved collaboration with James Ghawaly, who is spearheading AI enhancements to Scalpel3, and LSU students who are developing techniques for recovering specific file types. Scalpel3 will be released as a free and open source platform in the near future.
Next Step
LSU's Scholarship First Agenda is helping achieve health, prosperity, and security for Louisiana and the world.