Recover files after deletion

Recover files after deletion

Had a customer that had deleted the photos on his cameras SD card. File system was fat32. To recover them I used an Ubuntu Linux program called Foremost and it worked really well.

source code http://foremost.sourceforge.net/

Grab foremost:
sudo apt-get install foremost

Have Foremost audit your drive for recoverable files: sdi was the sd card device. Audit.txt was output to /recovery/foremost so you have to su sudo to read it.
sudo foremost -w -i /dev/sdi -o /recovery/foremost

Have foremost recover jpg files:
sudo foremost -t jpg -i /dev/sdi -o /recovery/foremost

files output to directory /recovery/foremost/jpg.

I wish it was all that easy:)