Foremost-NG: An Open-Source Toolkit for Advanced File Carving and Analysis
File carving and data recovery are critical tasks in digital forensics, incident response, and malware analysis. The original Foremost tool, while powerful, has long suffered the lack of updates and limited file formats. This paper introduces Foremost-NG, a community-driven fork that significantly refactors the core structure, adds new file-format parsers (including EVTX, script files, Mach-O, and ELF executables), and integrates with VirusTotal for on-the-fly threat intelligence. By modernizing the carving engine, decoupling format-specific handlers, and embedding an HTTP-based lookup for hash-based analysis, Foremost-NG delivers a robust, extensible platform for modern forensic workflows, as well as facilitates the inclusion of new file-formats.
Authors
- Daniel Macêdo Batista (ORCID: https://orcid.org/0000-0002-4865-5896)
- Cristian H. M. Souza (ORCID: https://orcid.org/0000-0002-2395-9930)
Institutions
- Universidad San Pedro (PE)
- Chukyo University (JP)
Publication Details
- Published
- 2025-09-01
- DOI
- https://doi.org/10.5753/sbseg_estendido.2025.12307
- Primary Topic
- Digital and Cyber Forensics
- Type
- article
- Field-Weighted Citation Impact
- 0.00