Getting back data with Foremost

Posted on July 26, 2015 • 3 minutes • 438 words • Suggest Changes

So you deleted something from a Linux system ? No shame in that, I done it tons of time, not gone judge you for not having backups. We live in an age where data is really, really big and disks are still rather small. (while this is irony, it is kinda true)

So I had to use data recovery since I managed to get my USB stick broken (RAW, so generally no sane format), neither, Linux (crouton, ChromeOS) nor Windows 7 wanted to read from my USB stick anymore. So what now ?

Before you continue, read this warning : (its red so its important)

When something unexpected happened (disk broke, no backup, raid6 broke, ….), and your backup is not there, stop when you care about the data. You are not a data recovery expert, neither am I, tell your boss/mom/girlfriend/… and hope (s)he doesn’t blame you. Then call a data recovery service. Don’t try this if you care for the data. Unless its a CD of Justin Bieber, then just go ahead.

Foremost, is a console recovery tool that will try to find your files using the known patterns. For example, most files start off (header) with telling what they are, that is useful for the programs trying to read them.

Using this technique Foremost will read the entire disk/partition you select and will report back these files when found. While this in theory sounds rather simple method, disks are fragmented, meaning that one file might be written over a way larger space then it really needs, as the disk was filled up multiple times.

Running this tool, can be done on images as such if your disk is broken, running a dd first or even better dd_rescue and then playing with the image file itself might be better. While I had backup of the most important files anyway, and the stick wasn’t broken (I think) I just ran it straight from on the stick.

# find the correct disk
fdisk -l

# start the foremost run
foremost -i /dev/sdb

# start foremost only with jpeg
foremost -i /dev/sdb -t jpeg

The result :

File: /dev/sdd
Start: Mon Jul 27 09:06:19 2015
Length: 58 GB (63216549888 bytes)

Num      Name (bs=512)         Size      File Offset     Comment

0:      00475418.jpg           2 MB       243414016
1:      00482138.jpg          67 KB       246854656
2:      00483418.jpg         108 KB       247510016
3:      00492570.jpg         395 KB       252195840
4:      00495834.jpg         591 KB       253867008
....


Finish: Mon Jul 27 09:53:53 2015

3001 FILES EXTRACTED

jpg:= 2047
gif:= 709
mov:= 34
mp4:= 12
rif:= 24
htm:= 6
zip:= 23
png:= 138
pdf:= 8
------------------------------------------------------------------

Foremost finished at Mon Jul 27 09:53:53 2015