Foremost Cheat Sheet

File carving tool that recovers files from disk images by header/footer signatures when filesystem metadata is missing.

Forensics & IRcarvingdiskrecoveryUpdated 2026-06-02

Overview

foremost scans unallocated space and raw images for known file signatures (JPEG, PDF, ZIP, etc.). Use when partitions are corrupt, formatted, or in CTF “find the hidden file” challenges alongside binwalk.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

sudo apt install -y foremost

foremost -V

Essential commands

Carve from image (output to output/ by default)

foremost -i disk.img

Specify output directory

foremost -i disk.img -o carved/

Only certain types

foremost -t jpg,pdf,zip -i disk.img -o carved/

Common workflows

Full carve after imaging —

foremost -i evidence.dd -o /cases/case01/carved/

ls -la /cases/case01/carved/jpg/

file /cases/case01/carved/pdf/*

png y 89504E470D0A1A0A

foremost -c custom.conf -i image.raw -o out/

Pipe from another tool —

dd if=usb.dd bs=512 skip=1000 count=10000 | foremost -t zip -o zip_chunk/

Compare with binwalk —

binwalk -e firmware.bin

foremost -i firmware.bin -o foremost_out/

diff -r _firmware.bin.extracted/ foremost_out/ 2>/dev/null | head

Audit log —

foremost -i disk.img -o carved/ -v

cat carved/audit.txt

Flags reference

`-i FILE`	Input image
`-o DIR`	Output directory
`-t types`	File types (jpg,gif,zip,...)
`-c CONFIG`	Custom config file
`-b SIZE`	Disk sector size (default 512)
`-s NUM`	Skip NUM bytes before scan
`-l NUM`	Length to scan
`-v`	Verbose / audit
`-d`	Debug

Tips

Carved files lack original filenames — hash and catalog manually.
False positives common for zip — verify with unzip -t or file.
For NTFS deleted files, tsk_recover may give better names than foremost.
Run on E01 after ewfmount or convert to raw for compatibility.