foremost 介绍


foremost 首页
foremost 源代码版本库


foremost - 司法程序来恢复丢失的文件

:~# foremost -h
foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w -d] [-t <type>] [-s <blocks>] [-k <size>]
    [-b <size>] [-c <file>] [-o <dir>] [-i <file>]

-V  - display copyright information and exit
-t  - specify file type.  (-t jpeg,pdf ...)
-d  - turn on indirect block detection (for UNIX file-systems)
-i  - specify input file (default is stdin)
-a  - Write all headers, perform no error detection (corrupted files)
-w  - Only write the audit file, do not write any detected files to the disk
-o  - set output directory (defaults to output)
-c  - set configuration file to use (defaults to foremost.conf)
-q  - enables quick mode. Search are performed on 512 byte boundaries.
-Q  - enables quiet mode. Suppress output messages.
-v  - verbose mode. Logs all messages to screen

foremost 示例

搜索选择文件类型(-t DOC,JPG,PDF,XLS)指定的图像文件(-i image.dd):

:~# foremost -t doc,jpg,pdf,xls -i image.dd
Processing: image.dd

:~# ls output/
audit.txt  jpg  pdf