Perhaps not everyone knows that when you delete files from our devices, they are not deleted, but only “hidden” waiting to be overwritten, and it is precisely for this reason that we believe that the files deleted can be recovered (always if you are not already been overwritten).
Foremost is a program open source a command line to Linux that recovers deleted files. It is of extreme simplicity, present in the repository and performs its job without fuss. As stated in the site, Foremost was originally developed for l '”Air Force Office of Special Investigation” U.S., and for the “center studies and research information security and systems“. Subsequently was released the source code and even the general public could benefit from the advantages offered by Foremost.
We begin to install it its Debian / Ubuntu:
sudo apt-get install foremost
Foremost is also present in the repository Fedora, should not be difficult to run the command:
yum -y install foremost
Now that the tool is installed must have a clear idea of which partition to recover. Suppose you need to retrieve the contents of the deleted partition “
We will first need indicate the destination dei file recover. Keep in mind that the larger the partition you want to recover, we will have more space in the destination.
First mount the partition:
sudo mount /dev/hdc3/recovery
Now creiamo the directory “foremost“:
sudo mkdir /recovery/foremost
Now we can Foremost perform:
sudo foremost -i /dev/hdc1 -o /recovery/foremost
This command retrieves all files in the partition, depending on the size can put even a long time. While the program is working, you can go to the folder “foremost” and appear to see the recovered files in real time.
Now suppose you want to retrieve only the files with a given extension. The command will be this:
sudo foremost -t jpg -i /dev/hdc1 -o /recovery/foremost