Joe Stewart

Latest Version

Foregone is a forensic file recovery tool written in Perl. It was inspired by the Air Force Office of Special Investigations' forensic tool known as "Foremost", which uses defined headers and footers of certain file types to search a raw disk image and extract files with those characteristics. Foregone is a Perl implementation of the same technique with some added features:

  • Only searches for headers starting on a block boundary, for a speed increase
  • Uses compression to reject interleaved blocks of dissimilar files

Foregone should not be considered an investigative-level forensic tool, but merely a utility that may help you recover files from a corrupted filesystem.

License Agreement

Agree and Download

Please note that SecureWorks cannot provide support for these tools, but feedback is appreciated.

Next Steps

Contact Us Call Us Today
(877) 838-7947
UK +44 131 260 3044


Online Tools

  • Print this Page
  • Share This Resource

By completing this form you'll be opting in to receiving future communications about products and services from Dell SecureWorks.