Digital Forensics

foremost

foremost recovers files by carving — it scans a disk image (or raw device) for the headers and footers that mark the start and end of known file types, and pulls out everything it recognizes, with no need for an intact filesystem. Point it at a disk image, a memory dump, or unallocated space and it reconstructs the JPEGs, PDFs, documents, and archives hiding in the bytes. It’s scriptable and non-interactive, which makes it the tool of choice when you want carving as a repeatable step rather than a guided session.

Official-repo package; Security → Digital Forensics → foremost.

The help it prints

foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t <type>] [-s <blocks>] [-k <size>] 
	[-b <size>] [-c <file>] [-o <dir>] [-i <file] 

-V  - display copyright information and exit
-t  - specify file type.  (-t jpeg,pdf ...) 
-d  - turn on indirect block detection (for UNIX file-systems) 
-i  - specify input file (default is stdin) 
-a  - Write all headers, perform no error detection (corrupted files) 
-w  - Only write the audit file, do not write any detected files to the disk 
-o  - set output directory (defaults to output)
-c  - set configuration file to use (defaults to foremost.conf)
-q  - enables quick mode. Search are performed on 512 byte boundaries.
-Q  - enables quiet mode. Suppress output messages. 
-v  - verbose mode. Logs all messages to screen

Examples

# Carve everything foremost recognizes from an image
foremost -i disk.img -o recovered/

# Only recover specific types (jpg and pdf)
foremost -t jpg,pdf -i disk.img -o recovered/

# Enable the thorough (indirect block) scan
foremost -T -i disk.img -o recovered/

# Carve from a raw device
sudo foremost -t all -i /dev/sdb -o recovered/

foremost writes an audit.txt summarizing what it found, and sorts recovered files by type. For interactive recovery with filesystem repair, testdisk is the companion tool.