Foremost and Scalpel are not interested in the underlying filesystem. They simply expect the data blocks of the files to reside sequentially in the image under investigation. The tools will find images in dd dumps, RAM dumps, or swap files.

Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery.

foremost is a forensics application to recover files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. This short article shows how you can use foremost to recover deleted files.

Ever deleted an important file? I haven’t recently done this on Linux, but when I used Windows I had a utility for recovering deleted files. Ubuntu Unleashed reported on some data recovery methods on Ubuntu, so I decided to try one of them out.

One of my neighbours came to me a couple of days ago with a problem… he’d lost his CV to a windows virus and had no backup. So I said I’d try to recover the file for him. A quick google led me to Foremost. I chose foremost because it’s small, fast and easy to use.

PhotoRec is a file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its 'Photo Recovery' name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media's filesystem has been severely damaged or re-formatted.

Plenty of utilities can recover deleted files, but what if you can't boot your computer, or the whole drive has been formatted? Here's how to dig deep and recover the most elusive deleted files, or even whole partitions.

You can’t always blame data loss on hardware failure. A clumsy user can be just as harmful. PhotoRec is a nifty little command-line based tool that can recover accidentally deleted files.

The rm command can be a powerful tool for deleting data -- until you delete the wrong files or directories. Thankfully, the ext3undel utility can recover accidently removed data on ext3 filesystems.