• Home
  • Blog
  • Books
    • Web Penetration Testing Like The Pros
    • Application Security Pre-Engagement
  • Online Courses
    • Kali Linux Training
    • Exploitation Development Using The Metasploit Framework
    • Learning The Social Engineer Toolkit
    • Cryptography Using Python
    • Pentests Automation
    • Python & Kali Linux
  • About Me
  • Contact the author

File Recovery and Data Carving using Foremost

May 27, 2018

Foremost is a simple and effective CLI tool that recovers files by reading the headers and footers of the files. You can start Foremost by clicking on:

Applications > Forensics > foremost

 

 

Once Foremost is successfully started, a Terminal opens, displaying the program version, creators, and some of the many switches that can be used:

 

To have a better understanding of Foremost and the switches used, try browsing the Foremost System Manager’s Manual. This can be done by entering the following command:

 

man foremost

 

The syntax for using Foremost is as follows:

foremost -i (forensic image) -o (output folder) -options

In this example, the 11-carve-fat.dd file located on the desktop is specified as the input file (-i) and an empty folder named Foremost_recovery is specified as the output file (-o). Additionally, other switches can also be specified as needed.

To begin carving the 11-carve-fat.dd image with Foremost, type the following command in the Terminal:

foremost -i 11-carve-fat.dd -o Foremost_recovery

Although the characters found look quite unclear while processing, the results will be clearly categorized and summarized in the specified output folder. It is important that the specified output folder be empty or you will encounter problems, as shown in the following screenshot:

 

Viewing Foremost results

Once Foremost has completed the carving process, you can proceed to the Foremost_recovery output folder:

 

If you open the output directory, you can see the carved items, categorized by file type, along with an audit.txt folder, which contains details of the findings:

In the audit.txt file, you can see a list of the items found by Foremost, along with their Size and File Offset location:

When scrolling down on the audit.txt file, you should see a summary of the files found, which is particularly useful when carving larger images:

The first three files listed in the audit.txt files are .jpg image files, and you can see these files in the jpg sub-folder within the Foremost_recovery output folder:

As you can see, Foremost is quite a powerful data recovery and file carving tool. File carving can take very long, depending on the size of the drive or image used. If the type of the file that needs to be recovered is already known, it is wise to specify this file type using the -t option to reduce time taken.

 

More About This Topic

If you want to know more about this topic I have a recommendation for you, the book Name is Digital Forensics with Kali Linux. The book is written by Shiva V.N. Parasram, an IT and cybersecurity professional  and in fact he’s a major contributor to this article as well.

 

It's only fair to share...Share on Facebook
Facebook
Tweet about this on Twitter
Twitter
Share on LinkedIn
Linkedin
Share

Ethical Hacking  / Forensics

GusKhawaja

  • The Best H@ckinG Book

    Hack Like The Pros

    Practical Web Penetration Testing

     

  • Do You Want More Like This!




© Copyright Ethical Hacking Blog