Recover Deleted Files with Foremost
Thursday, April 10th, 2008
Ever deleted an important file? I haven’t recently done this on Linux, but when I used Windows I had a utility for recovering deleted files.
Foremost is a command line utility for finding and recovering deleted files based on their type. It was origionally developed for the US Air Force Office of Special Investigations.
How is this type of data recovery possible? When you delete a file, the data is not really overwritten. The pointer in the filesystem to the file is simply removed so the disk area can be overwritten when necessary. The more the disk is written to after the file is deleted, the larger the chance it will be overwritten and become unrecoverable.