Foremost — Forensics | Tools

Description

Foremost is a console program to recover files based on their headers, footers, and internal data structures. Originally developed for the US Air Force Office of Special Investigations and The Center for Information Systems Security Studies and Research.

Installation

BASH

sudo apt install foremost

Basic Usage

                        BASH
                        
                            # Recover all supported file types
foremost -i disk.dd -o output/

# Recover specific types
foremost -t jpg,png,pdf -i disk.dd -o output/

# From raw device
sudo foremost -i /dev/sdb -o output/

Advanced Usage

                        BASH
                        
                    

                            # Verbose output
foremost -v -i disk.dd -o output/

# Specific file types
foremost -t all -i disk.dd -o output/
foremost -t doc,xls,ppt -i disk.dd -o output/    # Office docs
foremost -t zip,rar,gz -i disk.dd -o output/       # Archives

# Custom config for special file types
# Edit /etc/foremost.conf to add custom signatures

# Quick mode (faster, less thorough)
foremost -q -i disk.dd -o output/
                        

Common Workflows

                        BASH
                        
                    

                            # CTF file recovery
foremost -t all -i challenge.dd -o recovered/
ls -la recovered/*/
# Check audit.txt for summary
cat recovered/audit.txt
                        