The Foremost Open Source Forensic Tool
By Ray Strubinger, August 06, 2003
Several open source forensic tools have been created for the Unix platform; most notably, The Coroner's Toolkit (TCT) by Dan Farmer and Wietse Venema, as well as The @stake Sleuth Kit (TASK) and its browser-based front end, Autopsy, both created by Brian Carrier. While TCT and TASK/Autopsy have been written about frequently, there is another very useful application known as "foremost" that has received relatively little attention outside of a few computer forensics mailing lists.
Figure 3 Output displayed while foremost is running
foremost version 0.64
Written by Kris Kendall and Jesse Kornblum.
Verbose mode on
Output directory: /home/image/foremost-output
Configuration file: /home/image/foremost.conf
Opening ext2-home.dd
Total file size is 681574400 bytes
ext2-home.dd: 1.5% of image file read (10.0 MB)
ext2-home.dd: 3.1% of image file read (20.0 MB)
.
.
ext2-home.dd: 78.5% of image file read (510.0 MB)
A pdf was found at: 530647127
Wrote file 00000000.pdf -- Success
ext2-home.dd: 80.0% of image file read (520.0 MB)
.
.
ext2-home.dd: 84.6% of image file read (550.0 MB)
A htm was found at: 573793842
Wrote file 00000001.htm -- Success
.
.
.
ext2-home.dd: 98.5% of image file read (640.0 MB)
A htm was found at: 670277120
Wrote file 00000033.htm -- Success
ext2-home.dd: 100.0% of image file read (650.0 MB)
foremost is done.
