Foremost (software)

Content sourced from Wikipedia, licensed under CC BY-SA 3.0.

Foremost is a forensic data recovery tool for Linux that recovers deleted files by “carving” them from a disk using file headers, footers, and data patterns. It was created in March 2001 to imitate the DOS program CarvThis, by Special Agents Kris Kendall and Jesse Kornblum of the U.S. Air Force Office of Special Investigations. In 2005, Nick Mikus extended it as part of a Naval Postgraduate School project to improve accuracy and extraction rates.

Foremost ignores the filesystem and reads the drive in segments, looking for file header types defined in its configuration. When it finds a match, it writes the header and following data to an output file, stopping at a footer or when a size limit is reached. It runs from the command line and has no graphical user interface.

It can recover many common file types, including: jpg, gif, png, bmp, avi, exe, mpg, wav, wmv, mov, pdf, ole, doc, zip, rar, htm, and cpp. Additional file types can be added via a configuration file (usually /usr/local/etc/foremost.conf).

Foremost can recover data from image files or directly from disks using ext3, NTFS, or FAT filesystems, and it can even be used to recover data from iPhones. The latest stable release is 1.5.7 (June 15, 2011). It is released into the public domain by the U.S. government, and its source code is available.