How to use Foremost to recover deleted files in Linux

The rm command is one of the most dangerous commands for Linux users. If you delete the wrong file or directory, you can make your entire operating system unusable. Recovering lost files is not easy, but it is also not possible. Foremost is designed to diagnose your hard drive in order to recover any files you have deleted. This article provides a tutorial on how to use the Foremost tool.

What is foremost?

Developed by US federal agencies, Foremost (link: http://foremost.sourceforge.net/ ) is open source software. Instead of trying to retrieve files from the hard drive's file system, Foremost tries to directly recreate those files.

How to use Foremost to recover deleted files in Linux Picture 1

Most operating systems do not delete files completely from the file system. They only delete metadata and leave the data written below. Foremost will then copy and analyze the drive for this information.

Foremost will store information temporarily using memory in your PC. From there, it will look for certain file segments (segments) until it matches other segments, stitching them together (like a jigsaw puzzle).

Foremost supports certain file types. Image files like JPG and GIF, Windows binary files like EXE, document files like DOC and PDF, as well as compressed file formats like ZIP or RAR are all supported.

Install Foremost in Linux

Foremost is available as a package to install in most default Linux repositories. You can install it from the terminal using the package manager used by the Linux distribution.

How to use Foremost to recover deleted files in Linux Picture 2

Debian and Ubuntu-based distributions can install Foremost by opening a terminal and typing the following:

 sudo apt install foremost 

If you are running Arch Linux, you can install Foremost by entering:

 pacman -S foremost 

Fedora users can install Foremost from the terminal by typing:

 dnf install foremost 

How to use Foremost

If you have deleted a file and want to retrieve it, you can use Foremost to search for all files of the same type that were previously deleted.

First, you will need to know your drive partition name in Linux, for example '/ dev / sda1'. If you do not know your partition, enter the following into the terminal:

 df -h 

You will see a list of hard drive partitions listed. Locate the drive you want Foremost to search, listed in 'Filesystem'.

How to use Foremost to recover deleted files in Linux Picture 3

Once you know your hard drive partition, you can use Foremost to search your drive. For example, if you are looking for a deleted PNG file, open a terminal window and type the following:

 foremost -v -t png -i /dev/sda1 -o ~/recovery/ 

Replace '/ dev / sda1' with your hard drive partition. The -t flag allows you to select the file type to search for. The -i flag selects the drive you want to search, while the -o flag lists the directory where any restored files are stored.

How to use Foremost to recover deleted files in Linux Picture 4

You can use a similar procedure for any type of file you want to use. Replace png with your file type. You can search the entire drive or through specific directories.

When Forecast completes the search, all the files it locates will be saved in the output directory you listed under the -o flag . If you have difficulty, you can search through the Forecast's user guide by typing in the terminal:

 man foremost 

Retrieve deleted data in Linux

There is no guarantee that Foremost can recover any data you have lost or deleted. However, this is still one of the best free tools for retrieving data.

Unless you're willing to spend money on a better tool, Foremost is one of the best options available for accessing data in Linux. If Foremost doesn't work in your case, there are other Linux recovery tools available that you can try instead.

Hope you are succesful.