In this tutorial I will teach you how to use foremost to recover deleted files from a disk.

A basic example of foremost usage is:

foremost -i /dev/sdb1
  • It will recover files from /dev/sdb1 and it will create an output folder in the current directory with those files and an audit file.
  • In this case, you will need to be a root user or use sudo. Recovered files will be owned by root (you can change the owner with chown when the process finishes).
  • Never use the same disk partition for searching and retrieving the files.

You can add more parameters to customise the searching:

  • -t <type>: recover only files of a specific format (jpg, png, pdf, etc.). More information on the man page.
  • -T: adds a timestamp to the output folder. By default, you need to rename or delete the output folder when running foremost multiple times.
  • -o <directory>: specify an output directory.
  • -v: enables verbose mode.
  • -q: enables quick mode.
  • You can find more info about all available parameters on the man page (man foremost).