0

In the foremost manual it says that it can be used to recover files using their headers, footers and data structures. Since file deletion does not actually erase data and data is still there until some other data overwrites it. Hence I tried to recover my video files (mp4 format) just after deleting it (files were in external drive). But it just created the mp4 folder and ran for near about half an hour but couldn't recover even one of the file (there were total of 20 video files).

The command I used was:

foremost -t mp4 .

I ran it inside the directory where the files were already present.

How can I recover those files? Any other effective method would also be encouraged.

  • TestDisk is excellent at recovering deleted files, sometimes with their original filenames, it could even browse all the files (regular and deleted) and allow copying just a few chosen ones. Or PhotoRec can search only free space & copy deleted/lost files too, with terminal/ascii gui menus and a constantly updated progress status. – Xen2050 Dec 18 '18 at 21:15
1

foremost needs access to the device containing the files, not the directory where it is mounted. In your case, assuming your external drive (and appropriate partition) ends up being /dev/sdc1, you'd make sure it's unmounted and run

foremost -t mp4 /dev/sdc1

You need to run this from a directory with enough room to store the recovered files.

Since it's a NTFS filesystem, you could try ntfsundelete instead (in the ntfs-3g package usually).

  • Thanks. But running it on a 1TB drive does not seem a good option I think. Would you suggest some other method in this case then? – Rakholiya Jenish Jun 6 '15 at 16:13
  • 1
    Why not? Forensics specialists routinely run it on multi-terabyte devices... What filesystem does your external drive use? – Stephen Kitt Jun 6 '15 at 16:15
  • NTFS file system. Also how much time do you think it will take to run foremost completely – Rakholiya Jenish Jun 6 '15 at 16:17
  • You could use ntfsundelete then. I don't know how long it would take foremost to run, since you're specifying the file type it should pretty much run as fast as the disk can be read. – Stephen Kitt Jun 6 '15 at 16:21
  • 1
    @RakholiyaJenish: Running ntfsundeleteon a 1TB NTFS volume would take anywhere from 3 to 5 hours depending on yr hw and configuration specifics. Just make sure the recovery setup is UPS-powered. If it crashes for any reason, yr erased volume won't be hurt and you can later resume yr recovery from the last inode where a file was successfully recovered. – Cbhihe Jul 14 '16 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.