foremost not finding anything

tonj · 11-06-2020, 04:03 AM

I'm running centos 6 on a vps and I deleted a very important folder containing a website. So I tried foremost but the program isn't finding a single thing. From what I gather I need to specify the partition to search on. If I run cat /proc/partitions I get nothing. so I did df-h and that shows:

Quote:

Filesystem Size Used Avail Use% Mounted on
/dev/simfs 15G 9.1G 6.0G 61% /
none 384M 4.0K 384M 1% /dev
none 384M 164K 384M 1% /dev/shm

I know the partition I need is is /dev/simfs. I managed to install foremost-1.5.7-1.el6.rf.x86_64 and ran it but this is the output I get:

Quote:

[root@vps ~]# foremost -a -t jpg,html -i /dev/simfs -v
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Fri Nov 6 09:28:56 2020
Invocation: foremost -a -t jpg,html -i /dev/simfs -v
Output directory: /root/output
Configuration file: /usr/local/etc/foremost.conf
Processing: stdin
|------------------------------------------------------------------
File: stdin
Start: Fri Nov 6 09:28:56 2020
Length: Unknown

Num Name (bs=512) Size File Offset Comment

the program just sits there doing nothing. there's a ton of stuff i just deleted (along with the folder I shouldn't have deleted) so it should be finding lots of things. thanks for any help.

tonj · 11-07-2020, 02:55 PM

bump
anyone?
please?

berndbausch · 11-07-2020, 08:29 PM

You could download the source from sourceforge and compile it with the DEBUG flag to get more output.

You could also use strace to see what system calls the program issues.

I don't know if you can download a copy of this root disk. If it's possible, run foremost on that copy to avoid loss of data.

descendant_command · 11-07-2020, 11:59 PM

Quote:

Originally Posted by https://linux.die.net/man/1/foremost

-i file
The file is used as the input file. If no input file is specified or the input file cannot be read then stdin is used.

You should use code tags for output, not quote.

tonj · 11-08-2020, 12:55 AM

thanks but I can't make a disk copy, this is a vps.
I don't see how compiling from source would help, if I have the program I have the program.
is my command wrong in some way?
I don't get this. why does the program just sit there and not do anything?

berndbausch · 11-08-2020, 01:16 AM

Quote:

Originally Posted by tonj

thanks but I can't make a disk copy, this is a vps.
I don't see how compiling from source would help, if I have the program I have the program.
is my command wrong in some way?
I don't get this. why does the program just sit there and not do anything?

Compiling from source enables you to switch on debug output.

MadeInGermany · 11-08-2020, 01:22 AM

Quote:

File: stdin

Means it runs on stdin.
It should say

Quote:

File: /dev/simfs

Ensure it can open it i.e. be root!
Check your invocation options!
What is -a and -v ?
Perhaps it is just

Code:

foremost -t jpg,htm -i /dev/simfs

tonj · 11-08-2020, 01:57 AM

my command does say /dev/simfs
I am running as root
foremost -t jpg -i /dev/simfs doesn't do anything. the cursor just drops to the next line and sits there doing nothing.
thanks for your input here.

boughtonp · 11-08-2020, 08:09 AM

Quote:

Originally Posted by tonj

the cursor just drops to the next line and sits there doing nothing.

It isn't doing nothing, it's waiting for input from stdin - as identified by the lines "Processing: stdin" and "File: stdin" in the output you posted in post #1.

In post #4 descendant_command quoted the relevant part of the manual to explain this behaviour:

Quote:

-i file
The file is used as the input file. If no input file is specified or the input file cannot be read then stdin is used.

Enabling debug mode may well tell you why Foremost cannot read the file.

tonj · 11-08-2020, 08:35 AM

as I understand it foremost doesn't come with a debug option

boughtonp · 11-08-2020, 08:49 AM

As per post #3, if you compile with DEBUG flag, you will enable over a hundred "ifdef DEBUG" blocks in the Foremost source code, which will enable things like:

Code:

#ifdef DEBUG
			printf("\n	Invalid directory type\n");
			printf("type:=%c size:=%lu \n", dir->type, dir->size);
#endif

There may also be useful information gleaned with strace, again as noted in post #3.