Foremost is a small, easy to use tool that can recover deleted or lost files from storage devices and disk images. It has built-in support for the following filetypes:

By providing a qualified configuration file, other filetypes (i.e. mp3) can be added.

Scalpel is a very similar tool since it is based on Foremost. However, it does not have built-in filetype support, so it needs a configuration file that contains at least one filetype specification. Scalpel uses some different techniques that might be faster in certain cases and it shows ETA information.

In this article I’ll describe how to install and use both tools on Mac OS X 10.8.

Please note: Foremost and Scalpel recover files by using file carving techniques. This means that the raw data stream of the analyzed disk or image is searched for common file headers to identify files – without using information of the file system. As a result of this technique, neither file names nor folder structures can be restored so the recovered files have to be viewed, renamed and re-organized one by one, manually. If the file system is intact, it might be better to use other tools.

Foremost

Installation

The sourcecode is available on the Foremost Sourceforge page: http://foremost.sourceforge.net/

First, the archive has to be extracted:

There is a little typo in the Makefile which prevents the manpage from being installed properly (I experienced this problem with Foremost 1.5.7 on Mac OS X 10.8). To fix it, open the Makefile in a text editor and look for the following two lines:

Substitue the “man1” by “man8”.

Now the tool can be compiled and installed using the Mac directives:

Usage

The tool can work directly on a mounted device or on a disk image. If you have to recover data from a disk that is suspected to be physically damaged, it might be better to create an image first because every operation on the disk might damage it further.

To determine the correct device name, you can use the following command:

To create an image of it, use dd. When using dd, be careful to not mix up the source and destination path or you might end up losing data. And make sure to not save the image on the source device. Also, since the image will be as big as the source device, make sure that your destination device has enough free space.

Basic usage (this will examine the given device or image and save all recoverable files in the current directory, using the standard configuration file):

Parameters can be added to the command, i.e.: -t specifies the filetypes to look for. If omitted, it’ll look for every built-in type (same as -t all). -T will add a timestamp to the output directory, which is useful if you run Foremost multiple times. -v will print a line to stdout every time a file has been recovered. -Q suppresses the progress indicator (which is just dots filling the screen, no ETA). With -o the output directory can be specified:

Configuration File

The included configuration file is located in:

This file will automatically be loaded if you don’t specify another one by using the -c switch. By default everything in this file is commented out, though. This means that Foremost will only look for the built-in types.

Important: as soon as you uncomment one filetype in the config, Foremost will look for this type only. To also look for built-in filetypes you have to use the -t switch when running Foremost (-t all if you want to look for all built-in types).

Example

The following screenshot shows how I have used Foremost to recover data from an 8 GB usb drive that has been formatted with the Windows NTFS filesystem.

Scalpel

Installation

The sourcecode is available on the Scalpel Github page: https://github.com/machn1k/Scalpel-2.0
In order to compile it, you also need TRE: http://laurikari.net/tre/download/

First, extract, compile and install TRE:

Then do the same with Scalpel:

Usage

Basic usage (this will examine the given device or image and save all recoverable files in the current directory, using the configuration file found in the current directory):

The default configuration file can be found in the downloaded Scalpel archive:

Uncomment the desired filetypes before running Scalpel.

To find out more about the available parameters, check the manpage or run “foremost -h”.

Example

The following screenshot shows how I have used Scalpel to recover JPG and PDF files from a previously created image of a formatted USB stick: