Foremost recovering deleted files from Linux

Foremost we can only recover deleted files in Linux, as long as they are not overwritten on the hard disk.

Install first

to install foremost on CentOS, we will download and install the first RPM from the official website. Open the terminal and execute the following command

$ sudo yum install https:///forensics.cert.org/centos/cert/7/x86_64//  Foremost-1.5.7-13.1.el7.x86_64.rpm-y

with Ubuntu, the most important packages can use the default repository. To install the most important on Ubuntu, run the following command from the terminal

$ sudo apt-get installation most important

Now we will use the first utility to recover the image and run the following command to recover the file

Foremost-t jpeg-i/dev/sda1

here, through the options ' t ', we have defined the types of files that need to be recovered

-I, tell the most important thing is to find the file in partition ' /dev/sda1 ' . We can check the partition with the ' Mount ' command.

after the command is successfully executed, the file is restored in the current folder. We can also add an option to use the option ' o ' to recover files in a particular folder

$ foremost-t jpeg-i/dev/sda1-o/Root/test_folder

Note: The recovered file differs from the original file name because the file name is not stored with the files themselves. So the file name will be different, but the data should be there.

Foremost recovering deleted files from Linux