Following my previous article, I’m writing my experience with foremost.

My mother had its Windows XP/Vista ravaged out by her son. She was very happy with Linux Mint until she asked me: «Where are our dog’s photos? They were stored in $randomproprietaryapplication with the extension .ads and I can’t find them».

Ooops. I wiped it. «Gimme the laptop mom, I’l, find them.»

I used foremost as follows:

foremost -v -t jpeg -i /dev/sda1 -o /media/Enermax/BKP

According to the audit.txt file, it scanned 108GB of disk in 1 hour, and found 19517 jpegs. OMG OMG OMG.

So let’s narrow it down a bit, shall we? I made a little script that moves files bigger than a predefined size (in this case, 500000) in another directory (jpg500):

#!/bin/bash
i=0
for filename in $( ls jpg/* ); do
	filesize=$(stat -c%s "$filename")
	if [ $filesize -gt 500000 ]; then
		mv $filename jpg500
		i=$((i+1))
	fi
done
echo $i

Well, here are the statistics:

• JPEGs bigger than 500KB: 1773, only valuable pics
• Between 400KB and 500KB: 0
• Between 300KB and 400KB: 0
• Between 200KB and 300KB: 776, valuable pics
• Between 100KB and 200KB: 1441, valuable pics
• Between 50KB and 100KB: 0
• Between 40KB and 50KB: 1087, here you find thumbnails and crap
• Below 40KB: 14440, crap to be shredded

So, rule of thumb, know your target. If you want to recover pics taken with your digital camera, go for the 500KB+ files. If you want to recover everything, stay above 100KB. Below 100KB, it’s only waste.