Recover deleted files with foremost
In this tutorial I will teach you how to use
foremost to recover deleted files from a disk.
Table of Contents
A basic example of
foremost usage is:
foremost -i /dev/sdb1
- It will recover files from
/dev/sdb1and it will create an
outputfolder in the current directory with those files and an audit file.
- In this case, you will need to be a root user or use sudo. Recovered files will be owned by root (you can change the owner with
chownwhen the process finishes).
- Never use the same disk partition for searching and retrieving the files.
- You can also use
foremostwith disk images (you don’t need to run the command as root).
You can add more parameters to customise the searching:
-t <type>: recover only files of a specific format (
-T: adds a timestamp to the output folder. By default, you need to rename or delete the output folder when running
-o <directory>: specify an output directory. If, for example,
-Tparameter is used, foremost will create a folder named
-v: enables verbose mode.
-q: enables quick mode.
- You can find more info about all available parameters on the man page (
If you have any suggestion, feel free to contact me via social media or email.
Latest tutorials and articles: