Bad Computer Days - Foremost

Before there was MS Windows there was DOS. The emergence of DOS is a story of theft and hegemony in its own right. DOS was spartan and clever programmers wrote utilities which greatly expanded its power. One of those programmers was Peter Norton and one of those utilities was "undelete". When a file was deleted, DOS hammered the first character of the file name in the "directory". Peter's program asked you to "guess" the first character, usually not that difficult a task, and fixed the directory entry.

But there are many reasons why files disappear - hard disks corrupt, partitions get deleted, partitions get formatted, file allocation tables go awry, directories get mangled, etc. Simple tricks no longer work and "magic" is required. One of those bits of magic is Foremost. Foremost was developed by the US Airforce Office of Special Investigations. Foremost recognizes files in raw data on a storage device, carves them out, and drops them in a directory. One could speculate why an investigative unit would want such a tool but suffice it to say both innocent and naughty stuff can be recovered from a storage device that the owner thought had been lost or deleted.

We recently ran foremost on a digital camera SD card and recovered hundreds of photos presumed lost to the delight of the camera owner. Foremost is a command line utility that runs on *nix (Linux, Unix, BSD ...). It is free, proprietary versions are available that cost hundreds. Users of other operating systems (such as Windows XP) can obtain an iso of the Clonezilla-SysRescCD from the Hellenic Linux User Group. You won't have to learn Greek but intellectual investment is required. Expert tutoring is available from LSNet staff and you can get LSNet staff to do the job for you and return your lost data on CD, DVD or Flash Drive.