provocativo_
back to the arsenal
// arsenal·Forensics & REBeginnerFOSS

Foremost

File-carving tool — recovers files from raw disks/images by magic-byte headers.

Forensics & RE

$ foremost --help

Foremost

// what it is

Description

USAF-originated file carver. Reads a disk image and pulls out files based on header/footer signatures, ignoring filesystem metadata entirely. Indispensable for recovering deleted files from unformatted media.

// use cases

What people use it for

  • Carve files from a raw disk
  • Recover deleted JPEG/PDF/DOCX

// commands

The commands you'll type

Carve to ./output

$ foremost -i disk.img -o output/

// facts

category
Forensics & RE
platforms
LIN
license
FOSS
difficulty
Beginner

// related in Forensics & RE