# Filecarving with Foremost

<div align="center"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FyghZkOmnOPLlHvRYBTBL%2Ffilecarving.jpg?alt=media&#x26;token=14d3cfb1-85cd-42ba-a7e7-99dd4dd76a2c" alt=""></div>

### 1. Introduction

> In this lab, a disk image file “evidence.img” is provided in the home directory of the root user (/root/). One of the JPEG files present on the disk contains the flag.

Extract files from the given image using [**Foremost**](http://foremost.sourceforge.net/) tool and retrieve the flag!

**Guidelines:**

* [viu tool](https://github.com/atanunq/viu) can be used to view image files on command-line interface (CLI).

### 2. Filecarving with Foremost

First let’s check the command reference of the tool foremost that is linked above.

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FHYkUjrjouPtYD6vDiOKy%2Fforemost1.png?alt=media&#x26;token=f0bd8fe8-53f3-4f26-9eb1-ee44be898332" alt=""></div>

`foremost -v -i evidence.img -o output`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FDzjEXJrHoOTCO0IY8TCw%2Fforemost2.png?alt=media&#x26;token=442b45ae-9fd6-4c3c-8828-22b908f00ab6" alt=""></div>

As we can see, one jpg file got extracted. Let’s open that file with the viu tool.

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FvmE3TUPrdtt7lFQ6mT7N%2Fforemost3.png?alt=media&#x26;token=75060c65-9dd9-42ee-872d-52428519185e" alt=""></div>

### 3. Retrieve the flag

`cd output/jpg`

`viu 00263184.jpg`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FFN0DJB1LNBNOBM9xOFBj%2Fviu1.png?alt=media&#x26;token=7d74fdd0-f72a-4ff1-8460-f0c8b2722e2a" alt=""></div>

### 4. Summary

{% embed url="https://vimeo.com/676578569" %}
