FOREMOST(8) System Manager's Manual FOREMOST(8) (NAME) foremost - (headers) (footers) (SYNOPSIS) foremost[-h][-V][-d][-vqwQT][-b][-o] [-t][-s][-i] (BUILTIN FORMATS) -t. jpg JFIF Exif . gif png bmp bmp . avi exe Windows PE DLL EXE . mpg MPEG ( 0x000001BA ). mp4 wav riff AVI RIFF (RIFF) . . wmv : wma- . mov pdf ole OLE . PowerPoint Word Excel Access StarWriter . doc : OLE . OLE . zip : jar. . Open Office XML zip . SXW SXC SXI ?SX OpenOffice . Office 2007 XML (PPTX DOCX XLSX). rar htm cpp C C . all . [ -t ] (DESCRIPTION) . -h . -V . -d (indirect block) . -T . -v (verbose). . -q (quick mode). . . foremost . JPEG Microsoft Word . NTFS . NTFS (Master File Table MFT) . -Q (Quiet mode). . -w (write audit only). . -a . -b foremost . . . : foremost -b 1024 image.dd -k (chunk size) foremost . (RAM) . . : foremost -k 500 image.dd -i . (stdin) . -o . -c . "foremost.conf" "/etc/foremost.conf" . . (CONFIGURATION FILE) . -s . : foremost -s 512 -t jpeg -i /dev/hda1 (CONFIGURATION FILE) foremost . foremost.conf . . ! / () . (#) . . () \x[0-f][0-f] () \[1-9][1-9][1-9] . \s . : "\x4F\123\I\sCCI" "OSI CCI" . ( wildcard) ? . ? ** . ! ? \x3f \063 . README . (EXAMPLES) jpeg foremost -s 100 -t jpg -i image.dd / ( ) foremost -av image.dd foremost -t all -i image.dd gif pdf foremost -t gif,pdf -i image.dd jpeg foremost -vd -t ole,jpeg -i image.dd foremost image.dd (AUTHORS) Kris Kendall Jesse Kornblum (United States Air Force Office of Special Investigations) . Nick Mikus (Naval Postgraduate School Center for Information Systems Security Studies and Research). Foremost NPS . (BUGS) foremost glibc 2.1.x () fseeko ftello . . (REPORTING BUGS) Foremost . (forensic integrity) . . : namikus AT users d0t sf d0t net (COPYRIGHT) . 17 USC 105 . . . (SEE ALSO) README . Foremost CarvThis (DOS) (Defense Computer Forensics Lab) . v1.5 FOREMOST(8)