HomeHowTo › Data Recovery With Foremost & Scalpel

Data Recovery With Foremost & Scalpel

Foremost is a small, easy to use tool that can recover deleted or lost files from storage devices and disk images. It has built-in support for the following filetypes:

avi bmp dll doc docx exe gif htm jar jpg mbd mov mp4 mpg ole pdf
png ppt pptx rar rif sdw sx sxc sxi sxw vis wav wmv xls xlsx zip

By providing a qualified configuration file, other filetypes (i.e. mp3) can be added.

Scalpel is a very similar tool since it is based on Foremost. However, it does not have built-in filetype support, so it needs a configuration file that contains at least one filetype specification. Scalpel uses some different techniques that might be faster in certain cases and it shows ETA information.

In this article I’ll describe how to install and use both tools on Mac OS X 10.8.

Please note: Foremost and Scalpel recover files by using file carving techniques. This means that the raw data stream of the analyzed disk or image is searched for common file headers to identify files – without using information of the file system. As a result of this technique, neither file names nor folder structures can be restored so the recovered files have to be viewed, renamed and re-organized one by one, manually. If the file system is intact, it might be better to use other tools.

 

Foremost

Installation

The sourcecode is available on the Foremost Sourceforge page: http://foremost.sourceforge.net/

First, the archive has to be extracted:

tar -xvzf foremost-1.5.7.tar.gz
cd foremost-1.5.7

There is a little typo in the Makefile which prevents the manpage from being installed properly (I experienced this problem with Foremost 1.5.7 on Mac OS X 10.8). To fix it, open the Makefile in a text editor and look for the following two lines:

macinstall: MAN = /usr/share/man/man1/
macuninstall: MAN = /usr/share/man/man1

Substitue the “man1” by “man8”.

Now the tool can be compiled and installed using the Mac directives:

sudo make mac
sudo make macinstall

 

Usage

The tool can work directly on a mounted device or on a disk image. If you have to recover data from a disk that is suspected to be physically damaged, it might be better to create an image first because every operation on the disk might damage it further.

To determine the correct device name, you can use the following command:

diskutil list

To create an image of it, use dd. When using dd, be careful to not mix up the source and destination path or you might end up losing data. And make sure to not save the image on the source device. Also, since the image will be as big as the source device, make sure that your destination device has enough free space.

sudo dd if=<source> of=<dest> conv=noerror,sync
sudo dd if=/dev/disk1 of=/Volumes/EXTHDD/disk.img conv=noerror,sync

Basic usage (this will examine the given device or image and save all recoverable files in the current directory, using the standard configuration file):

sudo foremost /dev/disk1
sudo foremost -i disk.img

Parameters can be added to the command, i.e.: -t specifies the filetypes to look for. If omitted, it’ll look for every built-in type (same as -t all). -T will add a timestamp to the output directory, which is useful if you run Foremost multiple times. -v will print a line to stdout every time a file has been recovered. -Q suppresses the progress indicator (which is just dots filling the screen, no ETA). With -o the output directory can be specified:

sudo foremost -t pdf,jpg -T -v -Q -o /Users/acidx/Desktop/RECOVERY /dev/disk1

 

Configuration File

The included configuration file is located in:

/usr/local/etc/foremost.conf

This file will automatically be loaded if you don’t specify another one by using the -c switch. By default everything in this file is commented out, though. This means that Foremost will only look for the built-in types.

Important: as soon as you uncomment one filetype in the config, Foremost will look for this type only. To also look for built-in filetypes you have to use the -t switch when running Foremost (-t all if you want to look for all built-in types).

 

Example

The following screenshot shows how I have used Foremost to recover data from an 8 GB usb drive that has been formatted with the Windows NTFS filesystem.

foremost_usage_example

 

Scalpel

Installation

The sourcecode is available on the Scalpel Github page: https://github.com/machn1k/Scalpel-2.0
In order to compile it, you also need TRE: http://laurikari.net/tre/download/

First, extract, compile and install TRE:

tar -xzvf tre-0.8.0.tar.gz
cd tre-0.8.0
./configure
make
sudo make install

Then do the same with Scalpel:

unzip Scalpel-2.0-master.zip
cd Scalpel-2.0-master
./configure
make
sudo make install

 

Usage

Basic usage (this will examine the given device or image and save all recoverable files in the current directory, using the configuration file found in the current directory):

sudo scalpel /dev/disk1
sudo scalpel disk.img

The default configuration file can be found in the downloaded Scalpel archive:

conf/scalpel.conf

Uncomment the desired filetypes before running Scalpel.

To find out more about the available parameters, check the manpage or run “foremost -h”.

 

Example

The following screenshot shows how I have used Scalpel to recover JPG and PDF files from a previously created image of a formatted USB stick:

scalpel_usage_example

2 Comments.[ Leave a comment ]

  1. thank you it works fine (running Foremost 1.5.7 on Mac 10.8.5)!

    but I had others issues and had to edit the Makefile again

    macinstall: MAN = /usr/share/man/man1/
    macuninstall: MAN = /usr/share/man/man1 replacing man1 by man8 is right

    also I had to change those paths so the right way is:

    macinstall: BIN = /usr/bin/
    macinstall: MAN = /usr/share/man/man8/
    macinstall: CONF = /etc/

    the original paths were wrong in that Makefile (usr/local/bin or usr/etc/)

    thx for all

    A

  2. Thank you i did as the steps and get my files back. Thank you very much!!!!!

Leave a Comment