Foremost (software)
| Foremost
|
|
|---|---|
 Help text from Foremost |
|
| Basic data
|
|
| developer | Kris Kendall, Jesse Kornblum, Nick Mikus |
| Publishing year | March 5, 2001 |
| Current version | 1.5.7 (May 6, 2009) |
| operating system | Unix-like (GNU / Linux , x BSD , Mac OS X ...) |
| programming language | C. |
| category | Data recovery |
| License | public domain |
| foremost.sf.net | |
Foremost is free software for the recovery of deleted, not yet overwritten files or files from damaged file systems by means of carving . It is a command line tool for Unix-like operating systems (GNU / Linux , x BSD , Mac OS X , Solaris ...). There is now also a Windows version. It was developed in the C programming language and was unconditionally released into the public domain as free software, including its source code .
Functionality
Foremost searches for known starting sequences and then interprets the entire sequence up to the associated ending sequence as a file. In addition to a number of built-in file recognition patterns, you can also define your own. In the case of a fragmented file, the system aborts at a maximum file size defined for each file type. It can only handle files up to two gigabytes in size.
history
Foremost was originally developed since March 2001 by Jesse Kornblum and Kris Kendall in their roles as special agents for the United States Air Force Office of Special Investigations . The DOS software "CarvThis", which was developed by the Defense Computer Forensics Laboratory (DCFL) of the Department of Defense Cyber Crime Center (DC3), served as a model. On March 5th, version 0.1 was published as the first prototype under the name "snarfit". The software "Scalpel" was split off from Golden G. Richard III on the basis of the source code of version 0.69 from Foremost , which Foremost's authors recommend as a better alternative. In addition, Foremost served as the inspiration for tcpxtract, written by Nick Harbor.