Foremost File Carver

Recover deleted files and carve data from disk images using foremost.

Tool Status

• Tool installed: !command -v foremost > /dev/null 2>&1 && echo "YES -- $(foremost -V 2>&1 | head -1 || echo 'foremost available')" || echo "NO -- Install: brew install foremost (macOS) | apt install foremost (Debian/Ubuntu)"
• Wrapper scripts available: !test -f scripts/foremost/recover-deleted-files.sh && echo "YES -- use wrapper scripts for structured JSON output" || echo "NO -- using standalone mode with direct commands"

Mode: Wrapper Scripts Available

If wrapper scripts are available (shown as YES above), prefer these commands. They provide structured JSON output and educational context.

File Recovery

• bash scripts/foremost/recover-deleted-files.sh <disk-image> -j -x -- Recover deleted files from disk images using header/footer signatures

Targeted Carving

• bash scripts/foremost/carve-specific-filetypes.sh <disk-image> -j -x -- Carve specific file types (jpg, pdf, doc, zip) from disk images