foremost
A tool for recovering files from their headers and footers in image files or drives.
Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery. Originally developed by the United States Air Force Office of Special Investigations and The Center for Information Systems Security Studies and Research , foremost has been opened to the general public. We welcome any comments, suggestions, patches, or feedback you have on this program. Please direct all correspondence to [email protected].
shadawck/awesome-anti-forensicRelated projects:
| Repository | Description | Stars |
|---|---|---|
 mkdika/lff-cr | A utility program to find large files in a directory | 18 |
 mhogomchungu/sirikali | A Qt/C++ GUI front end to various encrypted file systems and SSHFS | 785 |
 lcorbasson/scrounge-ntfs | A tool for recovering data from damaged NTFS partitions. | 11 |
 rusty-ferris-club/recon | Reconnaissance tool for searching and querying files on a host for security experts | 32 |
 chris-huxtable/front_matter.cr | Parser for separating metadata from file content | 11 |
 sstadick/crabz | A cross-platform compression and decompression tool written in Rust. | 333 |
 pauldreik/rdfind | A utility tool that compares files based on their content and identifies duplicates to help compress backup directories or reduce data redundancy. | 996 |
 rubencaro/harakiri | Helps an application automatically restart or take other actions when specific files change on disk. | 21 |
 harveybates/kandle | Automates the process of importing external components into KiCad projects by handling unzipping, directory structure creation, and automatic linking of symbols and footprints. | 29 |
 runestubbe/crinkler | An executable file compressor tool specifically designed for small 32-bit Windows demoscene executables. | 1,081 |
 vishaltelangre/ff | A command-line tool for efficiently searching files by name in a directory or its subdirectories. | 332 |
 orlikoski/cylr | A tool that collects and preserves forensic artifacts from NTFS file systems without impacting the host system. | 652 |
 dustincampbell/csharpessentials | A collection of tools to simplify C# development with Roslyn diagnostics and code fixes. | 160 |
 klezvirus/cheesetools | Tools for exploiting vulnerabilities in Windows systems to facilitate lateral movement and code execution | 692 |
 svetlitski/fcp | A fast alternative to Unix cp command for copying large files and directories | 766 |