Linux command
foremost 命令
文件
复制后可按需替换文件名、目录或参数。
常用示例
Recover files from disk image
foremost -i [disk.img] -o [output_dir]
Recover specific file types
foremost -t [jpg,png,pdf] -i [disk.img]
Recover from device
sudo foremost -i [/dev/sda1] -o [output_dir]
Show all recoverable types
foremost -h
Verbose output
foremost -v -i [disk.img] -o [output_dir]
Use custom config
foremost -c [foremost.conf] -i [disk.img]
说明
foremost is a file carving tool for recovering files from disk images or devices. It searches for file headers and footers, extracting data between them regardless of filesystem state. The tool is useful for data recovery and forensic analysis, recovering files even from corrupted or partially overwritten media.
参数
- -i _input_
- Input file or device.
- -o _directory_
- Output directory.
- -t _types_
- File types to extract.
- -c _file_
- Configuration file.
- -v
- Verbose output.
- -V
- Display version.
- -q
- Quick mode.
- -a
- Write all headers.
- -w
- Only write audit file.
FAQ
What is the foremost command used for?
foremost is a file carving tool for recovering files from disk images or devices. It searches for file headers and footers, extracting data between them regardless of filesystem state. The tool is useful for data recovery and forensic analysis, recovering files even from corrupted or partially overwritten media.
How do I run a basic foremost example?
Run `foremost -i [disk.img] -o [output_dir]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -i _input_ do in foremost?
Input file or device.