Forensic Data Carving using Foremost
Foremost is a program that is used to carve data from disk image files, it is an extremely useful tool and very easy to use.
For the purpose of this article we have used an Ubuntu disk image file and the process has been repeated twice. The purpose of doing so was to see if Foremost can carve data out of incomplete disk images as well. We have used Kali Linux but if you want you can install Foremost on pretty much any distro of Linux.
Here’s how it was done:
Navigate to the Applications menu in Kali, Forensics is option 11. The fifth option from top in the Forensics menu is Foremost. Click on it and let’s get to carving some data!!
Full Article Read here