How to preserve filename and folder structure when using foremost recovery program?

Question

I am desperately needing to run the linux recovery software foremost and preserve filenames and folder structure. As you might know the program renames the recovered files with a numerical value and then lists them within a list inside a file called audit.txt that it generates.

I found this ruby script in another question within this great community where someone is trying to achieve the exact same thing with foremost that I am. Someone replied to the question with an answer containing a ruby script with simple instructions to run it within the folder that contains the audit.txt file - I have tried this and nothing happens. I have tried while running foremost as well as after completed, and nothing happens. I simply get no terminal output when attempting to run the ruby script you see below.

File.read("audit.txt").scan(/-{4,}\n(File: .*?\n.*?)(?=-{4,})/m).flatten.map{|z| 
   f1=z.scan(/File: (.*?)\n/).flatten[0];
   f2=z.scan(/[0-9]+:\t(.*?) \t/m).flatten;
   extension=File.extname(f1);

   [
    f1,
    f2.find{|q| File.extname(q)==extension}
   ]
}.each{|k,v| 
  extension=File.extname(k);
  dirname=extension.sub(".","")
  File.rename("#{dirname}/#{v}","#{dirname}/#{k}")
}

Does anyone else know how to use the program foremost and preserve filename and folder structure? It is very critical that I am able to do this as foremost seems to be the one and only recovery program that is capable recovering my files, and I have tried roughly 30+ different recovery programs between both Linux and Windblows.

Answer 1

Well, that's just the problem with data recovery, isn't it?

It's the filesystem that knows about metadata such as folder structure and filenames and most importantly what's-where (file size, offset on disk, in case of fragmentation for each data segment, etc.).

If the filesystem is kaput, and you resort to carving raw data (which is what foremost, photorec and other such tools do), then there's no way to preserve filenames.

At most you can generate new filenames from within the data you carved (in case of JPEG, based on EXIF data, in case of ZIP/TAR archives there's filenames inside if you unpack them, code files sometimes have helpful headers about project name and author, etc.).

But for any file types that don't contain metadata about themselves, there is no filename, because only the filesystem itself knows.

A good file carver will tell you at which offset each file was found, and maybe something in the filesystem metadata will allow you to pull out a filename for a given offset (in theory it's possible for there to be more than one, if the file was hardlinked, or simply renamed and old metadata was left on disk).

But that requires such metadata to still exist, and someone or something to be able to understand the specific filesystem's internals to be able to interpret such metadata correctly. So basically, in order to preserve original folder and filename structure, one way or another, you'd somehow have to fix the filesystem itself.

It's certainly impossible to pull it out of an audit.txt that doesn't contain this info in the first place. So unless you're seeing something in your audit.txt that you want to use as the filename, that ruby script of yours is a dead end. You need one that pulls a rabbit out of the hat.