Some of the tools I run across, I’m a little scared of. Sometimes I find applications that I’ve never heard of, and even if I have a measure of confidence that I could use it, I’m not sure I’d want to.
But I’m not sure I’m game. Just the phrase “data carving” makes me shudder slightly.
As I understand it, foremost can read from physical drives or drive images, and uses file headers and footers to recover information chunks.
A lot of it is over my head. My best experiences with information recovery is limited to restoring deleted files. This might be a whole different game.
I plan to keep it in mind though. For as many times as I’ve shot my mouth off and suggested that a tool was somehow beyond my reach, there have been an equal number of times where I’ve come back, years later, to realize how useful it was.
I have a feeling this is one of those times. 😐