0

In the foremost manual it says that it can be used to recover files using their headers, footers and data structures. Since file deletion does not actually erase data and data is still there until some other data overwrites it. Hence I tried to recover my video files (mp4 format) just after deleting it (files were in external drive). But it just created the mp4 folder and ran for near about half an hour but couldn't recover even one of the file (there were total of 20 video files).

The command I used was:

foremost -t mp4 .

I ran it inside the directory where the files were already present.

How can I recover those files? Any other effective method would also be encouraged.

Improve this question
1
  • TestDisk is excellent at recovering deleted files, sometimes with their original filenames, it could even browse all the files (regular and deleted) and allow copying just a few chosen ones. Or PhotoRec can search only free space & copy deleted/lost files too, with terminal/ascii gui menus and a constantly updated progress status.
    – Xen2050
    Commented Dec 18, 2018 at 21:15

1 Answer 1

Reset to default
1

foremost needs access to the device containing the files, not the directory where it is mounted. In your case, assuming your external drive (and appropriate partition) ends up being /dev/sdc1, you'd make sure it's unmounted and run

foremost -t mp4 /dev/sdc1

You need to run this from a directory with enough room to store the recovered files.

Since it's a NTFS filesystem, you could try ntfsundelete instead (in the ntfs-3g package usually).

Improve this answer
5
  • Thanks. But running it on a 1TB drive does not seem a good option I think. Would you suggest some other method in this case then?
    – Rakholiya Jenish
    Commented Jun 6, 2015 at 16:13
  • 1
    Why not? Forensics specialists routinely run it on multi-terabyte devices... What filesystem does your external drive use?
    – Stephen Kitt
    Commented Jun 6, 2015 at 16:15
  • NTFS file system. Also how much time do you think it will take to run foremost completely
    – Rakholiya Jenish
    Commented Jun 6, 2015 at 16:17
  • You could use ntfsundelete then. I don't know how long it would take foremost to run, since you're specifying the file type it should pretty much run as fast as the disk can be read.
    – Stephen Kitt
    Commented Jun 6, 2015 at 16:21
  • 1
    @RakholiyaJenish: Running ntfsundeleteon a 1TB NTFS volume would take anywhere from 3 to 5 hours depending on yr hw and configuration specifics. Just make sure the recovery setup is UPS-powered. If it crashes for any reason, yr erased volume won't be hurt and you can later resume yr recovery from the last inode where a file was successfully recovered.
    – Cbhihe
    Commented Jul 14, 2016 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .