6

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the hpp file extension, so I have to add it to the config file. So, following the instructions on the man page, I add the following line to the config file:

hpp n 50000 include include ASCII

Then I run foremost as follows:

$foremost -v -T -t hpp -i /dev/md0 -o /home/recover/

Instead of doing anything, it just displays the help message. If I change the hpp to htm or jpg, it works. So apparently foremost isn't accepting the custom file type I added into the config file. But I've looked over this dozens of times now, and I can't see what I'm doing wrong. I'm following the instructions exactly. Why doesn't foremost recognize the new file type I added to the config file?

3 Answers 3

6

I stumbled across the exact same issue and dug a little deeper into it by looking through the foremost sources.

It turns out custom types added using the configuration file cannot be selected with the -t option. Your files will be found if you define the hpp type in /etc/foremost.conf and use

foremost -v -T -c /etc/foremost.conf -i /dev/md0 -o /home/recover/

This will also recover files matching all builtin types which will probably mean a lot of files. To work around that, patch the sources to not include any of the builtin types when using -t all (equivalent to not using -t at all). In state.c, at the end of the set_search_def function, init_all is called if strcmp(ft, "all") == 0. Simply comment out the call to init_all and the builtin types will not be used anymore.

3

Create a new .conf file and remove everything in it except the settings for the type you need. an example would be (foremost_pde.conf):

pde y   200000  #include    #include    ASCII

make sure you delete all tab or space characters at the start of the line or otherwise the line will not be recognised. Save and close the conf file at a user location (e.g. ~/Desktop). Now use:

foremost -v -T -c ~/Desktop/foremost_pde.conf -i /dev/md0 -o /home/recover/
1
  • foremost have a lot of builtin types that will be collected without -t or with -t all, no matter how empty you keep your config file.
    – Gonmator
    Jun 18, 2021 at 17:14
0

Did you try to use -c config file option?

3
  • Yes, I tried it with -c /etc/foremost.conf
    – Channel72
    Aug 16, 2010 at 14:55
  • What happen if you don't use -t option?
    – lg.
    Aug 16, 2010 at 15:00
  • foremost -t all -i image.dd can you try this
    – Rajat
    Aug 16, 2010 at 15:01

You must log in to answer this question.