foremost
A forensic carver: reads a disk image, writes out everything whose signature it recognises, and nothing else.
What it does
Originally written for US Air Force investigators, foremost scans a device or image for file headers, footers and internal structure, and extracts each match into an output directory with an audit log. No filesystem is involved and none is needed.
foremost -t jpg,pdf,doc -i failing.img -o carved/
cat carved/audit.txtThe signature list is configurable in foremost.conf, which is the reason it survives in scripted pipelines: you can add a format nothing else recognises.
Notes
- Output directory must not exist, or it refuses. That is deliberate.
- No filenames, no timestamps, no directory structure — just contents grouped by type. Expect duplicates.
- Pair it with GNU ddrescue: image first, carve the image.
Alternative to
| Alternative | Type | Trade-off |
|---|---|---|
| PhotoRec | Open source | Hundreds more formats and better at recovering names; interactive |
| scalpel | Open source | A fork of this, faster on large images, unmaintained |
| The Sleuth Kit | Open source | Full forensic analysis rather than carving alone |
| Disk Drill | Freemium | The same operation with previews and no command line |
Install
brew install foremost