{"id":1221,"date":"2009-03-21T17:50:44","date_gmt":"2009-03-21T09:50:44","guid":{"rendered":"http:\/\/blog.smallken.ink\/2009\/03\/21\/linux\/ubuntu\/1221.html"},"modified":"2009-03-21T17:50:44","modified_gmt":"2009-03-21T09:50:44","slug":"foremost-%e6%95%91%e5%9b%9e%e5%b7%b2%e5%88%aa%e9%99%a4%e7%9a%84%e6%aa%94%e6%a1%88-for-debian-and-ubuntu-linux","status":"publish","type":"post","link":"https:\/\/blog.smallken.site\/?p=1221","title":{"rendered":"foremost \u6551\u56de\u5df2\u522a\u9664\u7684\u6a94\u6848 for Debian and Ubuntu Linux"},"content":{"rendered":"

\u5982\u679c\u4f60\u5728unix-like\u7cfb\u7d71\u4e0a\u9762\u8aaa\u8981\u6551\u56de\u5df2\u522a\u9664\u7684\u6a94\u6848\uff0c\u5927\u90e8\u5206\u7684\u4eba\u90fd\u6703\u8ddf\u4f60\u8b1b\u4e0d\u53ef\u80fd\uff0c\u4e0d\u904e\u9019\u7bc7\u570b\u5916\u7684\u6587\u7ae0\u6211\u883b\u597d\u5947\u7684\uff0c\u771f\u7684\u6709\u9019\u9ebc\u795e\u7684\u4e8b\uff0c\u5be6\u969b\u6e2c\u8a66\u7684\u78ba\u662f\u6709\u9019\u500b\u6a5f\u6703\u7684\u3002<\/p>\n

\u5b89\u88dd foremost\u5957\u4ef6\uff0c\u9069\u7528\u5728 Debian \u6216 Ubuntu \u4e0a
# apt-get install foremost<\/p>\n

\u5b89\u88dd\u597d\u4e4b\u5f8c\u770b\u4e00\u4e0b\u64cd\u4f5c\u624b\u518a<\/p>\n

# man foremost<\/p>\n

\u57fa\u672c\u4e0a\u4e0d\u662f\u6bcf\u500b\u6a94\u6848\u90fd\u652f\u63f4\uff0c\u652f\u63f4\u4ee5\u4e0b\u683c\u5f0f\u6a94\u6848\uff1a <\/p>\n

jpg\u3001gif\u3001png\u3001bmp\u3001avi\u3001exe\u3001mpg\u3001wav\u3001riff\u3001wmv\u3001mov\u3001ole\u3001doc\u3001zip\u3001rar\u3001cpp<\/p>\n

\u958b\u59cb\u5be6\u6e2c\u56c9
# pwd
\/root<\/p>\n

\u6211\u5728 \/root \u5e95\u4e0b\u6709\u4e00\u500b\u6a94\u6848\uff0c\u53ebestatement.pdf
# ls -l
total 44
-rw-r–r– 1 root root 43204 Mar 20 20:15 estatement.pdf<\/p>\n

\u6211\u628a\u5b83\u522a\u9664
# rm estatement.pdf<\/p>\n

\u7684\u78ba\u522a\u9664\u4e86
# ls -l
total 0<\/p>\n

\u82e5\u5df2\u7d93\u4e0d\u5c0f\u5fc3\u522a\u9664\u4e86\u6a94\u6848\u4e4b\u5f8c\uff0c\u4e0d\u8981\u518d\u5c0d\u78c1\u789f\u505a\u4efb\u4f55\u52d5\u4f5c\uff0c\u9019\u6a23\u6551\u6a94\u6848\u7684\u52d5\u4f5c\u6210\u529f\u6a5f\u7387\u624d\u6703\u5927\uff0c\u6240\u4ee5\u9019\u8edf\u9ad4\u6709\u8ddf\u4f60\u8aaa\u4e0d\u4fdd\u8b49\u4e00\u5b9a\u6551\u5f97\u56de\u4f86(Windows\u7cfb\u7d71\u61c9\u8a72\u4e5f\u662f\u9019\u6a23\u5b50)<\/p>\n

\u8981\u60f3\u6551\u56de\u6a94\u6848\uff0c\u9996\u5148\u8981\u6e05\u695a\u77e5\u9053\u6a94\u6848\u662f\u907a\u5931\u5728\u54ea\u4e00\u500b\u5206\u5272\u78c1\u5340?
# df -h
Filesystem            Size  Used Avail Use% Mounted on
\/dev\/sda1<\/strong>             7.6G  906M  6.3G  13% \/
varrun                125M   80K  125M   1% \/var\/run
varlock               125M     0  125M   0% \/var\/lock
udev                  125M   44K  125M   1% \/dev
devshm                125M     0  125M   0% \/dev\/shm<\/p>\n

\u56e0\u70ba\u9019\u53f0\u96fb\u8166\u53ea\u6709\u4e00\u500b\u5206\u5272\u78c1\u5340\uff0c\u6240\u4ee5\u5c31\u662f \/dev\/sda1\u4e86<\/p>\n

\u6307\u4ee4\u5982\u4e0b\uff0c-t \u5f8c\u9762\u63a5\u6a94\u6848\u683c\u5f0f\uff0c\u5982:pdf\uff0c-i \u5f8c\u9762\u63a5\u907a\u5931\u5728\u54ea\u4e00\u500b\u78c1\u5340\u4e2d
# foremost -t pdf  -i \/dev\/sda1
Processing: \/dev\/sda1
|*********<\/p>\n

\u7d93\u904e\u5e7e\u5206\u9418\u7684\u78c1\u789f\u6383\u63cf\u4e4b\u5f8c\uff0c\u5b83\u6703\u5728\u4f60\u4e0b\u6307\u4ee4\u7684\u7576\u4e0b\u76ee\u9304\u7522\u751f\u4e00\u500b output \u76ee\u9304\uff0c\u6240\u4ee5\u8981\u5c0f\u5fc3\u539f\u672c\u76ee\u9304\u4e0b\u5c31\u5df2\u7d93\u6709\u81ea\u5df1\u7684\u76ee\u9304\u525b\u597d\u4e5f\u662f\u53d6\u540d\u70baoutput\u6642\uff0c\u9700\u6ce8\u610f\u4e00\u4e0b\uff0c\u4e0d\u7136\u6703\u88ab\u84cb\u6389\u3002
# ls -l
total 4
drwxr-xr– 3 root root 4096 Mar 21 17:33 output<\/p>\n

# cd output\/<\/p>\n

~\/output# ls
audit.txt  pdf<\/p>\n

\/output\u76ee\u9304\u5e95\u4e0b\u7684 audit.txt\u662f\u5168\u90e8\u627e\u5230\u6551\u56de\u7684.pdf\u6a94\u6848\u7684\u6e05\u55ae
~\/output# cat audit.txt<\/p>\n

File: \/dev\/sda1
Start: Sat Mar 21 17:33:30 2009
Length: 7 GB (8167670784 bytes) <\/p>\n

Num      Name (bs=512)         Size      File Offset     Comment <\/p>\n

0:      02284816.pdf         165 KB      1169825792
1:      15270001.pdf          16 MB      7818240712
2:      15417360.pdf          42 KB      7893688320
Finish: Sat Mar 21 18:49:00 2009 <\/p>\n

3 FILES EXTRACTED <\/p>\n

pdf:= 3
—————————————————————— <\/p>\n

Foremost finished at Sat Mar 21 18:49:00 2009<\/p>\n

\/output \u76ee\u9304\u5e95\u4e0b\u5247\u518d\u6709\u4e00\u500b\u76ee\u9304\u5b58\u653e\u8457\u627e\u56de\u7684 pdf \u6a94\u6848
~\/output# cd pdf\/
~\/output\/pdf# ls -l
total 16748
-rw-r–r– 1 root root   169301 Mar 21 17:53 02284816.pdf
-rw-r–r– 1 root root 16900749 Mar 21 18:46 15270001.pdf
-rw-r–r– 1 root root    43204 Mar 21 18:47 15417360.pdf<\/p>\n

\u96d6\u7136\u6211\u6b64\u6b21\u53ea\u522a\u9664\u4e00\u500b\u6a94\u6848\uff0c\u4f46\u662f\u5b83\u6703\u628a\u4ee5\u524d\u5230\u73fe\u5728\u53ef\u4ee5\u6551\u56de\u7684pdf\u5168\u90e8\u627e\u51fa\u4f86\uff0c\u6a94\u540d\u5c31\u8b8a\u6210\u7a0b\u5f0f\u4e82\u53d6\u7684\u6a94\u540d\u3002<\/p>\n

\u5be6\u6e2c\u9019\u4e09\u500b\u6a94\u6848\uff0c\u5176\u4e2d\u6211\u525b\u522a\u9664\u7684estatement.pdf\u6a94\u6848\u7684\u78ba\u6551\u56de\u4f86\u4e86\uff0c\u800c\u4e14\u53ef\u6b63\u5e38\u958b\u555f\uff0c\u4f46\u662f\u5176\u4e2d\u6709\u4e00\u500b\u6a94\u6848\u7121\u6cd5\u6b63\u5e38\u958b\u555f\u4e86\uff0c\u53ef\u80fd\u662f\u56e0\u70ba\u522a\u9664\u6642\u9593\u5df2\u7d93\u904e\u5f8c\u5f88\u4e45\u4e86\uff0c\u78c1\u789f\u5df2\u7d93\u906d\u8986\u5beb\u8cc7\u6599\u9032\u53bb\u4e86\uff0c\u6240\u4ee5\u771f\u7684\u7121\u6cd5\u4fdd\u8b49\u5168\u90e8\u6a94\u6848\u5747\u80fd\u6551\u56de\uff0c\u4f46\u662f\u7b2c\u4e00\u6642\u9593\u99ac\u4e0a\u6551\uff0c\u5927\u81f4\u4e0a\u6c92\u4ec0\u9ebc\u554f\u984c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u5982\u679c\u4f60\u5728unix-like\u7cfb\u7d71\u4e0a\u9762\u8aaa\u8981\u6551\u56de\u5df2\u522a\u9664\u7684\u6a94\u6848\uff0c\u5927\u90e8\u5206\u7684\u4eba\u90fd\u6703\u8ddf\u4f60\u8b1b\u4e0d\u53ef\u80fd\uff0c\u4e0d\u904e\u9019\u7bc7\u570b\u5916\u7684\u6587\u7ae0\u6211\u883b\u597d\u5947…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-1221","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/blog.smallken.site\/index.php?rest_route=\/wp\/v2\/posts\/1221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.smallken.site\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.smallken.site\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.smallken.site\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.smallken.site\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1221"}],"version-history":[{"count":0,"href":"https:\/\/blog.smallken.site\/index.php?rest_route=\/wp\/v2\/posts\/1221\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.smallken.site\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.smallken.site\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.smallken.site\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}