Recover Permanently Deleted Files Using Foremost

Recover Permanently Deleted Files Using Foremost

In this article we are going to learn digital forensic using our Kali Linux.

Today we are going to recover permanently deleted or lost files using foremost forensic tool even it can recover files from formatted media drives.

Foremost is a very useful open source forensic utility that is able to recover deleted files using the technique called data carving.
This utility was originally developed by the united states air force office of special investigations and is able to recover several file types like videos, office files, images, zip and more.
Foremost is a forensic program to recover lost files based on their headers, footers, and internal data structures.
It's also support for specific file types can be added by the user via the configuration file.
The program can also work on partition images produced by DD or similar tools.
This tool is very effective for forensic use like recover any data from a criminal's pendrive.
Since foremost is already present in all the major linux distributions repositories so installing it is a very easy task.
All we have to do is to use our favorite distribution package manager on debian and ubuntu we can use apt.

Installing Foremost Tool In Kali Linux:

root@kali:~# sudo apt install foremost

Usage of Foremost Tool:

Now it's time to recover our permanently deleted data.
If we need to recover permanently deleted data from a pen drive we need to know the pen drive's disk path.

Finding Pendrive Disk Path:

root@kali:~# sudo fdisk -l

Here you have to find your pendrive
It's look like /dev/sdb
And It's partitions like /dev/sdbX (X is number and its varies)
here let's assume that our pendrive location is /dev/sdb and the main partition of our pendrive is /dev/sdb1.
This /dev/sdb1 is the memory storage partition we can copy this path or just remember this.

Normal/Easy Usage of Foremost:

The most basic way to use foremost is by providing a source to scan for deleted files.
It can be either a partition or an image file like those generated with DD.
Let's see an example we want to scan the /dev/sdb1 partition.

Note: before we begin a very important thing to remember is to never store retrieved data on the same partition we are retrieving the data from to avoid overriding delete files still present on the block device.
Now the command we would run is

root@kali:~# sudo foremost -i /dev/sdb1

Here i means input device(path)

By default the program creates a directory called output inside $HOME/username directory and a subdirectory for each supported file type we are attempting to retrieve is created.
Each directory will hold the corresponding file type obtained from the data carving process when foremost completes its job empty directories are removed.
Only the ones containing files are left on the file system.
This lets us immediately know what type of files were successfully retrieved.
The audit.txt file contains information about the actions performed by the program.

By default the program tries to retrieve all the supported file types, to restrict our search we can use the 't' option and provide a list of the file types we want to retrieve separated by a comma.
In our case we restrict the search only to png,zip and jpg files
So type this command,

root@kali:~# sudo foremost -v -q -t png,zip,jpg -i /dev/sdbX -o $HOME/Desktop/recovered_files

In above command we use,
-t flag to specify file types, if we did not use this foremost will recover all known file types
-v for verbose mode this mode will display all the process in screen
-q (queue) for quick mode
-i is for input devices, in our case our input device is our pen drive and the path is /dev/sdb1
-o to set the output directory that means where we want to keep our recovered files, here we choose the recovered folder in our desktop.

This process will take time because it will analyze the entire disk small size disks can be recovered very quickly it also takes time if we are recovering much data or we are not in quick mode.
If the deleted files are overwritten by other files then we may get trouble to recover those deleted files and made we get corrupted files after the recovery process.
We check our recovered folder in desktop here we have successfully recovered our deleted data in our pen drive.
Not only in digital forensic, we can use this free tool to recover data for our personal uses like we can recover data from our camera memory card or any other flash drives.
We will get many paid tools for this job but when we have a very powerful free tool then why do we pay for recovery tools.

Foremost Tool Help Command:

root@kali:~# foremost -h
foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t <type>] [-s <blocks>] [-k <size>]
[-b <size>] [-c <file>] [-o <dir>] [-i <file]

-V - display copyright information and exit
-t - specify file type. (-t jpeg,pdf ...)
-d - turn on indirect block detection (for UNIX file-systems)
-i - specify input file (default is stdin)
-a - Write all headers, perform no error detection (corrupted files)
-w - Only write the audit file, do not write any detected files to the disk
-o - set output directory (defaults to output)
-c - set configuration file to use (defaults to foremost.conf)
-q - enables quick mode. Search are performed on 512 byte boundaries.
-Q - enables quiet mode. Suppress output messages.
-v - verbose mode. Logs all messages to screen

Foremost Usage Example From Kali Linux Tools Website:

Search for a selection of file types (-t doc,jpg,pdf,xls) in the given image file (-i image.dd):

root@kali:~# foremost -t doc,jpg,pdf,xls -i image.dd
Processing: image.dd
|*|
root@kali:~# ls output/
audit.txt jpg pdf