April 2007 Archives

Using foremost which is a console program that recovers files based on their headers, footers, and internal data structures.

genhog foremost-1.5 # ./foremost -h
foremost version 1.5 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ]
[-b ] [-c ] [-o

Just lately, I was thinking about writing a tool that extracted binary streams out of a pcap (tcpdump) packet caputre file. No need to do that when someone else has already done that. Actually, you can use two tools, one is called tcpxtract and the other is foremost, the former built from the latter. The latest version of tcpxtract is version 1.0.1:

Usage: ./tcpxtract [OPTIONS] [[-d ] [-f ]]
Valid options include:
--file, -f to specify an input capture file instead of a device
--device, -d to specify an input device (i.e. eth0)
--config, -c use FILE as the config file
--output, -o dump files to DIRECTORY instead of current directory
--version, -v display the version number of this program
--help, -h display this lovely screen