Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the hpp file extension, so I have to add it to the config file. So, following the instructions on the man page, I add the following line to the config file:

hpp n 50000 include include ASCII

Then I run foremost as follows:

$foremost -v -T -t hpp -i /dev/md0 -o /home/recover/

Instead of doing anything, it just displays the help message. If I change the hpp to htm or jpg, it works. So apparently foremost isn't accepting the custom file type I added into the config file. But I've looked over this dozens of times now, and I can't see what I'm doing wrong. I'm following the instructions exactly. Why doesn't foremost recognize the new file type I added to the config file?

share|improve this question
add comment

3 Answers

Did you try to use -c config file option?

share|improve this answer
    
Yes, I tried it with -c /etc/foremost.conf –  Channel72 Aug 16 '10 at 14:55
    
What happen if you don't use -t option? –  lg. Aug 16 '10 at 15:00
    
foremost -t all -i image.dd can you try this –  Rajat Aug 16 '10 at 15:01
add comment

I stumbled across the exact same issue and dug a little deeper into it by looking through the foremost sources.

It turns out custom types added using the configuration file cannot be selected with the -t option. Your files will be found if you define the hpp type in /etc/foremost.conf and use

foremost -v -T -c /etc/foremost.conf -i /dev/md0 -o /home/recover/

This will also recover files matching all builtin types which will probably mean a lot of files. To work around that, patch the sources to not include any of the builtin types when using -t all (equivalent to not using -t at all). In state.c, at the end of the set_search_def function, init_all is called if strcmp(ft, "all") == 0. Simply comment out the call to init_all and the builtin types will not be used anymore.

share|improve this answer
add comment

Create a new .conf file and remove everything in it except the settings for the type you need. an example would be (foremost_pde.conf):

pde y   200000  #include    #include    ASCII

make sure you delete all tab or space characters at the start of the line or otherwise the line will not be recognised. Save and close the conf file at a user location (e.g. ~/Desktop). Now use:

foremost -v -T -c ~/Desktop/foremost_pde.conf -i /dev/md0 -o /home/recover/
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.