Foremost: Complete Guide to File Carving and Data Recovery Using Kali Linux

Foremost is a console-based file carving tool that recovers files based on their headers, footers, and internal data structures — a technique known as “file carving.” Unlike file-system-aware tools such as The Sleuth Kit, Foremost does not rely on file system metadata (inodes, MFT entries, directory structures) at all. Instead, it scans raw data — a disk image, a memory dump, or even unallocated space — byte-by-byte, looking for known file signatures (magic numbers) to identify the start and end of files, then extracts (“carves”) them regardless of whether the file system metadata pointing to them still exists.

Foremost was originally developed by the United States Air Force Office of Special Investigations (AFOSI) and The Center for Information Systems Security Studies and Research, making it one of the oldest and most trusted open-source carving tools in the forensic community. It is particularly useful for recovering deleted files after the file system metadata has been destroyed, or for extracting embedded files from an unknown/raw binary blob.

Key capabilities:

• Signature-based file carving from raw disk images, memory dumps, or arbitrary binary files
• Configurable file type support via foremost.conf
• Support for common file types: JPEG, GIF, PNG, BMP, PDF, DOC/DOCX, XLS/XLSX, ZIP, RAR, MP4, AVI, WAV, EXE, and more
• Quick mode for faster (but less thorough) carving aligned to sector boundaries
• Detailed audit log of all carved files for reporting purposes

Installation

Kali Linux (via APT):

sudo apt update
sudo apt install foremost -y

Verify installation:

foremost -V

Expected output:

foremost version 1.5.7
Written by Kris Kendall, Jesse Kornblum.

Manual build from source:

git clone https://github.com/korczis/foremost.git
cd foremost
make
sudo make install

Syntax

foremost [options] -i <input_file> -o <output_directory>

Command-Line Options

Basic Usage

Step 1 — Carve all supported default file types from an image:

foremost -i disk_image.dd -o /home/claude/foremost_output

Expected output:

Processing: disk_image.dd
|*|
Foremost finished at Sun Jul 19 10:40:12 2026

Step 2 — View the audit log:

cat /home/claude/foremost_output/audit.txt

Expected output:

Foremost version 1.5.7 audit file

File: disk_image.dd
Start: Sun Jul 19 10:39:50 2026

Num  Name          Size     File Offset  Comment
0:   00000000.jpg  245KB    102400
1:   00000001.pdf  1.2MB    524288

Step 3 — Check extracted files by type:

ls /home/claude/foremost_output/

Expected output:

audit.txt  jpg/  pdf/  doc/  zip/

Practical Examples with Output

Example 1: Basic full carve of a disk image

foremost -i evidence.dd -o /home/claude/case1_carved

Output:

Processing: evidence.dd
File: evidence.dd
Length: 10 GB (10737418240 bytes)

Num  Name          Size     File Offset  Comment
0:   00000000.jpg  128KB    2048
1:   00000001.png  56KB     264192
2:   00000002.pdf  890KB    1048576

Foremost finished at Sun Jul 19 10:42:33 2026

Example 2: Carving only specific file types (JPEG and PDF)

foremost -t jpeg,pdf -i evidence.dd -o /home/claude/jpeg_pdf_only

Output:

Processing: evidence.dd
0: 00000000.jpg  128KB  2048
1: 00000001.pdf  890KB  1048576
Foremost finished successfully.

Example 3: Quick mode carving for faster processing

foremost -q -i evidence.dd -o /home/claude/quick_carve

Output:

Processing: evidence.dd (quick mode - sector aligned)
Foremost finished at Sun Jul 19 10:45:02 2026
Files extracted: 87

Example 4: Using a custom configuration file

foremost -c /home/claude/custom_foremost.conf -i evidence.dd -o /home/claude/custom_carve

Output:

Loading custom configuration from /home/claude/custom_foremost.conf
Processing: evidence.dd
Foremost finished successfully.

Example 5: Carving with verbose output

foremost -v -i evidence.dd -o /home/claude/verbose_carve

Output:

foremost 1.5.7
Audit File

Configuration file: /etc/foremost.conf
Invocation: foremost -v -i evidence.dd -o /home/claude/verbose_carve
Output directory: /home/claude/verbose_carve
Found: jpg header at offset 2048
Found: jpg footer at offset 132096, size 128KB

Example 6: Carving from a raw memory dump

foremost -t exe,jpg,pdf -i memdump.raw -o /home/claude/mem_carve

Output:

Processing: memdump.raw
0: 00000000.exe  56KB   102400
1: 00000001.jpg   34KB  245760
Foremost finished successfully.

Example 7: Skipping bytes at the start of the input (skip partition table)

foremost -s 1048576 -i disk_image.dd -o /home/claude/skip_carve

Output:

Processing: disk_image.dd (starting at offset 1048576)
Foremost finished at Sun Jul 19 10:52:18 2026

Example 8: Writing only the audit log without extracting files (dry run)

foremost -w -i evidence.dd -o /home/claude/dryrun
cat /home/claude/dryrun/audit.txt

Output:

Num  Name          Size     File Offset
0:   00000000.jpg  128KB    2048
1:   00000001.pdf  890KB    1048576
(No files actually written - audit only mode)

Example 9: Time-stamped output directory for repeated runs

foremost -T -i evidence.dd -o /home/claude/case_output
ls /home/claude/case_output/

Output:

case_output_Sun_Jul_19_10_55_23_2026/

Example 10: Carving a USB image for deleted photos

foremost -t jpg,png,gif -i usb_image.dd -o /home/claude/usb_photos
ls /home/claude/usb_photos/jpg | wc -l

Output:

142

Common Use Cases

• Recovering deleted photos/videos: Common in law enforcement cases involving image evidence on formatted or damaged storage media.
• Recovering documents after file system corruption: When the MFT/inode table is damaged and standard file system tools like TSK cannot list files.
• Extracting files from unallocated space: Carving files that a suspect deleted and whose file system entries have been overwritten.
• Memory dump analysis: Carving executables or documents directly out of a RAM image alongside Volatility analysis.
• Rapid triage carving: Quick mode allows fast, sector-aligned carving during time-sensitive incident response.

Automation with Bash

#!/bin/bash
# foremost_batch.sh - Batch carving across multiple evidence images

EVIDENCE_DIR="$1"
OUTBASE="foremost_results_$(date +%Y%m%d_%H%M%S)"

if [ -z "$EVIDENCE_DIR" ]; then
    echo "Usage: $0 <evidence_directory>"
    exit 1
fi

mkdir -p "$OUTBASE"

for img in "$EVIDENCE_DIR"/*.dd "$EVIDENCE_DIR"/*.raw; do
    [ -e "$img" ] || continue
    name=$(basename "$img")
    echo "[*] Carving $name..."
    foremost -t jpg,png,pdf,doc,docx,zip,exe -i "$img" -o "$OUTBASE/${name}_carved"
    echo "[*] Files recovered from $name:"
    find "$OUTBASE/${name}_carved" -type f | grep -v audit.txt | wc -l
done

echo "[*] Batch carving complete. Results in $OUTBASE/"

Run:

chmod +x foremost_batch.sh
./foremost_batch.sh ./evidence_images/

Tips and Best Practices

1. Always work on a forensic copy of the evidence, never the original media.
2. Use -t to limit carving to relevant file types when you know what you’re looking for — this drastically improves speed and reduces false positives.
3. Avoid quick mode (-q) for thorough investigations; it can miss files that don’t start on a sector boundary.
4. Always review audit.txt — it provides a full accounting of every carved file, which is essential for chain-of-custody documentation.
5. Combine Foremost with Scalpel or bulk_extractor for cross-validation, since different carving engines can catch different files.
6. Customize foremost.conf to add or tune signatures for unusual/proprietary file formats relevant to your case.
7. Run carving on unallocated space specifically (extracted via blkls from Sleuth Kit) to reduce noise from already-known allocated files.
8. Hash all carved files immediately after extraction for evidentiary integrity.

Troubleshooting

References

• Official documentation (archived AFOSI/CISSR release): https://foremost.sourceforge.net
• GitHub mirror: https://github.com/korczis/foremost
• Kali Linux Foremost tool page: https://www.kali.org/tools/foremost/
• Original whitepaper: Kendall, K. & Kornblum, J., “Foremost: A digital forensics tool” (2001)