Foremost (software)
Forensic data recovery program
From Wikipedia, the free encyclopedia
Foremost is a forensic data recovery program for Linux that recovers files using their headers, footers, and data structures through a process known as file carving.[4] Although written for law enforcement use, the program and its source code are freely available and can be used as a general data recovery tool.[3]
| Foremost | |
|---|---|
Screenshot of foremost's -h (help) output on Xubuntu 11.04 | |
| Original authors | Special Agents Kris Kendall and Jesse Kornblum of the U.S. Air Force Office of Special Investigations |
| Initial release | March 5, 2001[1] |
| Stable release | 1.5.7[2]
/ 15 June 2011 |
| Written in | C[3] |
| Operating system | Linux |
| Size | 52.12 KB |
| Type | Data recovery |
| License | Public Domain (US Gov) Source code is available |
| Website | foremost.sourceforge.net |
History
Foremost was created in March 2001 to duplicate the functionality of the DOS program CarvThis for use on the Linux platform.[5] Foremost was originally written by Special Agents Kris Kendall and Jesse Kornblum of the U.S. Air Force Office of Special Investigations. In 2005, the program was modified by Nick Mikus, a research associate at the Naval Postgraduate School's Center for Information Systems Security Studies and Research as part of a master's thesis.[6] These modifications included improvements to Foremost's accuracy and extraction rates.[7]
Functionality
Foremost is designed to ignore the type of underlying filesystem and directly read and copy portions of the drive into the computer's memory.[4] It takes these portions one segment at a time, and using a process known as file carving searches this memory for a file header type that matches the ones found in Foremost's configuration file.[1] When a match is found, it writes that header and the data following it into a file, stopping when either a footer is found, or until the file size limit is reached.[5]
Foremost is used from the command-line interface, with no graphical user interface option available.[8] It is able to recover specific filetypes, including jpg, gif, png, bmp, avi, exe, mpg, wav, riff, wmv, mov, pdf, ole, doc, zip, rar, htm, and cpp.[9] There is a configuration file (usually found at /usr/local/etc/foremost.conf) which can be used to define additional file types.[10]
Foremost can be used to recover data from image files,[11] or directly from hard drives that use the ext3, NTFS, or FAT filesystems.[12] Foremost can also be used via a computer to recover data from iPhones.[13]
