Forensics
Foremost is a forensic data recovery program that recovers files based on their headers, footers, and internal data structures.
sudo apt install foremost
foremost -i <input> -o <output>
Foremost is a forensic file carving tool originally developed by the United States Air Force Office of Special Investigations. It recovers files from disk images by scanning for known file headers, footers, and internal data structures.
Foremost works by reading through a raw disk image or partition dump and identifying file boundaries based on signature matching. Once a file header is found, Foremost carves the data until the corresponding footer is reached or a maximum file size limit is hit.
While Foremost is fast and lightweight, it is limited to recovering contiguous file data and cannot handle fragmented files. For more comprehensive recovery, tools like PhotoRec or Scalpel may be more appropriate.
foremost image.ddCarve files from an image using the default config, writing to ./outputforemost -i image.dd -o outputExplicitly set the input file and output directoryforemost -t jpg -i image.ddRecover only JPEG files from the imageforemost -t jpg,pdf,doc -i image.dd -o recoveredCarve a comma-separated list of file types into a custom directoryforemost -t all -i image.dd -o outputAttempt to recover every file type known to foremostforemost -i /dev/sdb -o carvedCarve directly from a raw block deviceforemost -v -t png -i image.ddVerbose mode: log all messages to the screen while carving PNGsforemost -T -t jpg -i image.ddAppend a timestamp to the output directory so it is not overwrittenforemost -c /etc/foremost.conf -i image.ddUse a specific configuration file defining headers/footersforemost -w -i image.dd -o audit_onlyOnly write the audit.txt file; do not extract files to diskforemost -a -t jpg -i image.ddWrite all headers and perform no error detection (recover corrupted files)foremost -q -i image.ddQuick mode: search only on 512-byte boundaries for speedforemost -Q -i image.dd -o outputQuiet mode: suppress on-screen output messagesforemost -d -i image.ddTurn on indirect block detection (for UNIX file systems)foremost -b 1024 -i image.ddSet the block size used during the search (default 512)Recover files that have been deleted from storage media by carving them based on file signatures.
Extract files from forensic disk images created with dd or other imaging tools.
Salvage files from damaged or corrupted storage media for forensic investigation.
Recover accidentally lost files from formatted or corrupted partitions.
Generates a folder structure containing the salvaged files, automatically sorted into subdirectories based on their file extensions.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.