foremost - Восстоновление данных

Взято http://linux.die.net/man/1/foremost

Recover files from a disk image based on headers and footers specified by the user.

-h - Показать справку
-V - Показать информацию об авторских правах
-d - Turn on indirect block detection, this works well for Unix file systems.
-T - Time stamp the output directory so you don't have to delete the output dir when running multiple times.
-v - Подробная информация о программе
-q - Быстрый поиск, ищутся файлы с длинными заголовками, может пропустить файлы. неподходит для NTFS
-Q - Скрытый режим, подавление большинства сообщений об ошибках
-w - только поиск файлов, ничего не восстановит
-a -
-b number
Allows you to specify the block size used in foremost. This is relevant for file naming and quick searches. The default is 512. ie. foremost -b 1024 image.dd

-k number
Allows you to specify the chunk size used in foremost. This can improve speed if you have enough RAM to fit the image in. It reduces the checking that occurs between chunks of the buffer. For example if you had > 500MB of RAM. ie. foremost -k 500 image.dd

-i file
The file is used as the input file. If no input file is specified or the input file cannot be read then stdin is used.
-o directory
Recovered files are written to the directory directory.
-c file
Sets the configuration file to use. If none is specified, the file "foremost.conf" from the current directory is used, if that doesn't exist then "/etc/foremost.conf" is used. The format for the configuration file is described in the default configuration file included with this program. See the CONFIGURATION FILE section below for more information.
-s number
Skips number blocks in the input file before beginning the search for headers. ie. foremost -s 512 -t jpeg -i /dev/hda1


Примеры
Search for jpeg format skipping the first 100 blocks
foremost -s 100 -t jpg -i image.dd
Only generate an audit file, and print to the screen (verbose mode)
foremost -av image.dd
Search all defined types

foremost -t all -i image.dd

Search for gif and pdf's

foremost -t gif,pdf -i image.dd

Search for office documents and jpeg files in a Unix file system in verbose mode.

foremost -vd -t ole,jpeg -i image.dd

Run the default case

foremost image.dd