Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.
In most cases, it is not necessary to configure Foremost, since in default operation, it already recognizes most of the usual file types. Nevertheless, one could add additional file headers for detection, e.g. adding entries or uncomment examples:
# wma y 8000000 \x30\x26\xB2\x75 \x00\x00\x00\xFF # # wma y 8000000 \x30\x26\xB2\x75 \x52\x9A\x12\x46 # mp3 y 8000000 \xFF\xFB??\x44\x00\x00 mp3 y 8000000 \x57\x41\x56\45 \x00\x00\xFF\ mp3 y 8000000 \xFF\xFB\xD0\ \xD1\x35\x51\xCC\ mp3 y 8000000 \x49\x44\x33\ mp3 y 8000000 \x4C\x41\x4D\x45\
Run following command with image or device path as parameter and additional path to an output directory:
# foremost -t all -i /path/to/image -o outputdir
-t all tries to recover all known file types.
- Homepage: https://foremost.sourceforge.net
- Entry in Forensicswiki.org: http://www.forensicswiki.org/wiki/Foremost