foremost
Forensicskali · parrotFile carving tool to recover files based on headers and footers.
Install
sudo apt install foremost
Common commands
foremost -i disk.img -o output/
Use only on systems you are authorized to test. Follow program scope.
Related tools
Volatility
featuredAdvanced memory forensics framework for analyzing RAM dumps.
Autopsy
Digital forensics platform with GUI on top of The Sleuth Kit.
exiftool
Read and write meta information in files — useful for OSINT on documents and images.
Mat2
Metadata anonymisation toolkit — strip EXIF and document metadata before sharing.