Foremost
Recover files by header/footer carving.
KaliParrotLinuxpassive
pkg: foremost
Foremost recovers deleted/embedded files from disk images or raw data using known file signatures.
Syntax
foremost [-t types] -i {image} -o {outdir}
Example
foremost -t jpg,pdf -i disk.img -o recovered
Carves JPEG and PDF files from the disk image into the recovered/ directory.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
foremost
Usage examples
foremost -t jpg,pdf -i disk.img -o recovered
Carve images and PDFs from a disk image.
Advantages
- Recovers files without a filesystem
- Signature-based carving
- Simple targeted recovery
Disadvantages
- Fragmented files recover poorly
- No filenames/metadata
- Output needs manual review
Tags
#carving#recovery
Official docs: Foremost ↗
Related commands
Frequently asked questions
What is Foremost used for?
Foremost recovers deleted/embedded files from disk images or raw data using known file signatures.
What is an example Foremost command?
A common example is: foremost -t jpg,pdf -i disk.img -o recovered — Carves JPEG and PDF files from the disk image into the recovered/ directory.
Is Foremost part of Kali Linux?
Yes. Foremost ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install foremost.
What category of security tool is Foremost?
Foremost is a Forensics tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.