The Foremost Open Source Forensic Tool
By Ray Strubinger, August 06, 2003
Several open source forensic tools have been created for the Unix platform; most notably, The Coroner's Toolkit (TCT) by Dan Farmer and Wietse Venema, as well as The @stake Sleuth Kit (TASK) and its browser-based front end, Autopsy, both created by Brian Carrier. While TCT and TASK/Autopsy have been written about frequently, there is another very useful application known as "foremost" that has received relatively little attention outside of a few computer forensics mailing lists.
Figure 2 Parameters that can be used with foremost
foremost version 0.64
Written by Kris Kendall and Jesse Kornblum.
ERROR: No image files specified.
Digs through an image file to find files within using header information.
Usage: foremost [-h|V] [-qv] [-s num] [-i <file>] [-o <outputdir>] \
[-c <config file>] <imgfile> [<imgfile>] ...
-h Print this help message and exit
-V Print copyright information and exit
-v Verbose mode. Highly recommended
-q Quick mode. Only searches the beginning of each sector. While
this is faster, you may miss some files. See man page for details.
-i Read names of files to dig from a file -o Set output directory for
recovered files
-c Set configuration file to use. See man page for format.
-s Skip n bytes in the input file before digging
Foremost is done.
