Recover files in linux using foremost

You know this problem, you deleted files from your usb drive/sd card and then you realise you shouldn’t have done that. There are a lot of free tools for windows that can recover your files for you, but finding an application that does the same thing in linux is a bit harder to find (maybe they just expect that linux users aren’t stupid enough to accidentally remove files :p ).
For this I have a solution, I found it on metacafe, but I think most people prefer a short explaining it rather than having to watch the whole 3 minutes long movie.
So here, in short, how to use foremost.

Step 1:
You need to copy the complete disk to an image file. This is the safest way of working and maybe even the only one (I don’t know if foremost works on mounted partitions and I’m not going to try it).
Lets assume I have an SD-card which on /dev/mmcblk0 and I want to copy the whole disk to a file name image.img on my desktop:

phillip@linux:~> dd if=/dev/mmcblk0 of=~/Desktop/image.img

When it’s done you get something like this:

1984000+0 records in
1984000+0 records out
1015808000 bytes (1.0 GB) copied, 139.309 s, 7.3 MB/s

Step 2:
Now we have copied the whole card to my desktop (~/Desktop), I’d like to recover all my files to a folder named recovery which is on my desktop (~/Desktop/recovery). You’ll probably have to create this directory first (mkdir ~/Desktop/recovery). For this I’ll be using a great application called foremost, which you can download here.

phillip@linux:~/Desktop> foremost -o ~/Desktop/recovery/ -t all i ~/Desktop/image.img

Recovering files with Foremost

Foremost creates a directory for every file extension in the folder ~/Desktop/recovery.

Hope this might be useful for someone out there wink . If something isn’t clear, you’re free to ask or you can watch the metacafe video since it a bit more verbose.

This post was originally posted on my My.Opera blog on Sunday, February 15, 2009 3:18:49 PM. This post has been copied to my WordPress blog since the My.Opera blogging service will be discontinued.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s