Foremost

Free plan LinuxMac

What Foremost is

Foremost is a free console program for recovering files with data carving on Linux and macOS. It can examine raw data, disk-image files, or a drive directly. Image files may come from tools such as dd, Safeback, and Encase. Foremost identifies content through file headers, footers, and internal data structures. Built-in file types can be selected with command-line switches, and the README says their format-specific structures can support faster and more reliable recovery. A configuration file lets you define file extensions, case sensitivity, maximum size, headers, and optional footers for file types. Each entry can use forward, reverse, or next search modes, bounded by a maximum size. Examples in the configuration cover formats such as GIF, JPEG, PNG, BMP, TIFF, AVI, QuickTime, MPEG, Office, PDF, and audio files. Installation involves unpacking the archive, compiling it, and using make commands to install. Foremost began in 2001 and was originally developed by U.S. Air Force investigative and information-security organizations.

Who it suits

Foremost suits users who need command-line file recovery from drives or disk images on Linux or macOS. It also fits users who need custom signatures for additional file formats.

What it does well

Free plan
Scans drives and disk images
Built-in format-specific recovery types
Custom headers and optional footers
Forward, reverse, and next search modes

What to know first

Console-based workflow
Installation requires compiling from source
Linux and macOS platforms only

Verdict

Foremost provides configurable file carving for raw data, drives, and disk images. Its command-line design and source compilation suit technically comfortable users who need control over recovery signatures.

Facts from Foremost's own pages

Built-in types: The README says built-in types use file-format data structures for more reliable and faster recovery. · github.com, 11 Oct 2026
Configuration: The configuration file specifies each file type’s extension, case sensitivity, maximum size, and header; the footer is optional. · github.com, 11 Oct 2026
Custom formats: A configuration file lets users specify file types and their extensions, case sensitivity, maximum size, headers, and optional footers. · github.com, 11 Oct 2026
Example formats: The included configuration file contains examples for formats including AOL ART, GIF, JPEG, PNG, BMP, TIFF, AVI, QuickTime, MPEG, Office, PDF, and audio files. · github.com, 11 Oct 2026
Feedback: The repository description welcomes comments, suggestions, patches, and feedback, and gives [email protected] for correspondence. · github.com, 11 Oct 2026
File types: Built-in file types use their data structures for file recovery, and the README says this can make recovery more reliable and faster. · github.com, 11 Oct 2026
Founded: 2001 · github.com, 28 Sept 2026
Free plan: Yes · github.com, 24 Sept 2026
History: The README credits Special Agents Kris Kendall and Jesse Kornblum with writing Foremost starting in March 2001. · github.com, 11 Oct 2026
Input sources: It can scan image files created by tools such as dd, Safeback, and Encase, or scan a drive directly. · github.com, 11 Oct 2026
Installation: The README instructs users to unpack the archive, compile it, and install it with make commands. · github.com, 11 Oct 2026
Origin: The repository description says Foremost was originally developed by the U.S. Air Force Office of Special Investigations and the Center for Information Systems Security Studies and Research, then opened to the public. · github.com, 11 Oct 2026
Origins: The README credits Special Agents Kris Kendall and Jesse Kornblum of the United States Air Force Office of Special Investigations with starting the program in March 2001. · github.com, 11 Oct 2026
Operating systems: Linux · github.com, 24 Sept 2026
Platforms: The README gives build instructions for Linux, BSD, Solaris, and OSX. · github.com, 11 Oct 2026
Purpose: Foremost is a console program for recovering files through data carving, using file headers, footers, and internal data structures. · github.com, 11 Oct 2026
Search options: Configuration entries support forward, reverse, and next search modes, each bounded by a maximum size. · github.com, 11 Oct 2026
Signature selection: File headers and footers can be defined in a configuration file, and built-in file types can be selected with command-line switches. · github.com, 11 Oct 2026
Recovery sources: raw data,disk image files · github.com, 24 Sept 2026
Support: The repository README asks users to report bugs with a description, how they found the bug, and contact information. · github.com, 11 Oct 2026
Uninstall: The README says Foremost can be removed with make uninstall. · github.com, 11 Oct 2026
Use: The README directs users to the foremost man page for command-line arguments. · github.com, 11 Oct 2026