Saturday, May 25, 2013

Recovering your deleted files using - Foremost

I recently looking for data recovery tool to recover some files in my home folder. I was looking some recover tool for linux, and I found an interesting command line tool call Foremost.

Why is it so interesting ?

  • light weight and easy to install. 
  • Easy to use.
  • Built in file filters for fast recovery. ( e.g: jpg, zip, rar etc.)

How to install foremost.

Go to terminal and  type.

$ sudo apt-get install foremost


Recovering deleted jpgs files in partition

  1. First make an empty writable directory to save recover files in a partition other than that you are going to recover. ( let's say /recovery/data/ )
  2. Then run foremost.  I am going to recover my home partition ( let's say /dev/sda5).

  3. $ sudo foremost -t jpg -i /dev/sda5 -o /recovery/data

  4. Finally set user permission to /recovery/data/ to view image. type

  5. $ sudo chown YOUR_USER_NAME /recovery/data -R

Some important foremost command line arguments.
  • -i  :- partition/image to recover
  • -o :- location to store recovered files.
  • -t  :- built in file filter options.  you can give multiple filters by separating using commas. (e.g: for jpg and pdf: -t jpg,pdf ) 
  • -q :- quick mode.
 you can find more details about foremost in following locations.

  1. https://help.ubuntu.com/community/DataRecovery#Foremost
  2. http://linux.die.net/man/1/foremost