使用foremost恢复linux下已删除的文件

Version 1.0
Author: Falko Timme <ft [at] falkotimme [dot] com>
Last edited 12/03/2009

foremost is a forensics application to recover files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. This short article shows how you can use foremost to recover deleted files.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

Currently foremost can recover the following file types:

• jpg - Support for the JFIF and Exif formats including implementations used in modern digital cameras.
• gif
• png
• bmp - Support for windows bmp format.
• avi
• exe - Support for Windows PE binaries, will extract DLL and EXE files along with their compile times.
• mpg - Support for most MPEG files (must begin with 0x000001BA)
• wav
• riff - This will extract AVI and RIFF since they use the same file format (RIFF). note faster than running each separately.
• wmv - Note may also extract -wma files as they have similar format.
• mov
• pdf
• ole - This will grab any file using the OLE file structure. This includes PowerPoint, Word, Excel, Access, and StarWriter
• doc - Note it is more efficient to run OLE as you get more bang for your buck. If you wish to ignore all other ole files then use this.
• zip - Note is will extract .jar files as well because they use a similar format. Open Office docs are just zipâd XML files so they are extracted
  as well. These include SXW, SXC, SXI, and SX? for undetermined OpenOffice files.
• rar
• htm
• cpp - C source code detection, note this is primitive and may generate documents other than C code.

You can tweak /etc/foremost.conf to add support for more file types.

Please note that there's no guarantee that foremost will succeed in recovering your files, but at least there's a chance.

2 Installing foremost

On Debian and Ubuntu, foremost can be installed as follows:

apt-get install foremost

3 Using foremost

Take a look at

man foremost

to learn how to use foremost.

In this example I delete a jpg file:

server1:/home/administrator#ls-l
total324
-rw-r--r--1rootroot3243832008-02-1901:25k-p1170003_13_20080217_1058163689.jpg
server1:/home/administrator#

rm -f k-p1170003_13_20080217_1058163689.jpg

foremost can be used as follows to try to recover the file:

foremost -t jpeg -i /dev/sda1

(If you don't know what partition to search, take a look at

<!-- document.write('<div align="center">'); //-->

<!-- begin ad tag Rectangle B --> <noscript class="noscript-show">&lt;span class="noscript-show"&gt;&lt;a href="http://a.collective-media.net/jump/idgt.howtoforge.en/rec_b;tile=1;sz=300x250;ord=%5Btimestamp%5D?" target="_blank"&gt;&lt;img style="display: none;" src="http://a.collective-media.net/ad/idgt.howtoforge.en/rec_b;tile=1;sz=300x250;ord=%5Btimestamp%5D?" alt="" border="0" width="300" height="250"&gt;&lt;/a&gt;&lt;/span&gt;</noscript> <!-- End ad tag Rectangle B --> <!-- document.write('</div>'); //-->

mount

server1:~# mount
/dev/sda1 on / type ext3 (rw,errors=remount-ro)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
nfsd on /proc/fs/nfsd type nfsd (rw)
server1:~#

)

After foremost has finished, you will find a folder called output in the directory from where you called foremost:

ls -la

server1:~#ls-la
total36
drwxr-xr-x5rootroot40962009-03-1217:53.
drwxr-xr-x21rootroot40962009-02-1613:10..
drwx------2rootroot40962009-02-1613:15.aptitude
-rw-------1rootroot3772009-02-1613:32.bash_history
-rw-r--r--1rootroot4122004-12-1523:53.bashrc
drwxr-xr-x2rootroot40962009-02-1613:17.debtags
drwxr-xr--3rootroot40962009-03-1217:53output
-rw-r--r--1rootroot1402007-11-1918:57.profile
-rw-------1rootroot34802009-03-1217:06.viminfo
server1:~#

ls -l output

server1:~#ls-loutput/
total8
-rw-r--r--1rootroot7142009-03-1218:02audit.txt
drwxr-xr--2rootroot40962009-03-1217:57jpg
server1:~#

The audit.txt contains a summary of what foremost has done:

cat output/audit.txt

server1:~#catoutput/audit.txt
Foremostversion1.5.4byJesseKornblum,KrisKendall,andNickMikus
AuditFile

ForemoststartedatThuMar1217:53:482009
Invocation:foremost-tjpeg-i/dev/sda1
Outputdirectory:/root/output
Configurationfile:/etc/foremost.conf
------------------------------------------------------------------
File:/dev/sda1
Start:ThuMar1217:53:482009
Length:28GB(30836542464bytes)

NumName(bs=512)SizeFileOffsetComment

0:11157504.jpg320KB5712642048
1:29556752.jpg324KB15133057024
Finish:ThuMar1218:02:102009

2FILESEXTRACTED

jpg:=2
------------------------------------------------------------------

ForemostfinishedatThuMar1218:02:102009
server1:~#

And the jpg/ subdirectory contains the jpg files that foremost has recovered:

ls -l output/jpg/

server1:~#ls-loutput/jpg/
total660
-rw-r--r--1rootroot3284792009-03-1217:5511157504.jpg
-rw-r--r--1rootroot3325752009-03-1217:5729556752.jpg
server1:~#

Before you run foremost the next time from the same directory, you must either delete/rename the current output/ directory (because foremost will not start if there's already an output/ directory) or use the -T switch (time stamp the output directory so you don't have to delete the output/ dir when running multiple times):

foremost -t pdf -T -i /dev/sda1

4 Links

• foremost: http://foremost.sourceforge.net/