Foremost-NG: An Open-Source Toolkit for Advanced File Carving and Analysis

File carving and data recovery are critical tasks in digital forensics, incident response, and malware analysis. The original Foremost tool, while powerful, has long suffered the lack of updates and limited file formats. This paper introduces Foremost-NG, a community-driven fork that significantly refactors the core structure, adds new file-format parsers (including EVTX, script files, Mach-O, and ELF executables), and integrates with VirusTotal for on-the-fly threat intelligence. By modernizing the carving engine, decoupling format-specific handlers, and embedding an HTTP-based lookup for hash-based analysis, Foremost-NG delivers a robust, extensible platform for modern forensic workflows, as well as facilitates the inclusion of new file-formats.

Authors

Institutions

Publication Details

Published
2025-09-01
DOI
https://doi.org/10.5753/sbseg_estendido.2025.12307
Primary Topic
Digital and Cyber Forensics
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
article

Foremost-NG: An Open-Source Toolkit for Advanced File Carving and Analysis

Daniel Macêdo Batista, Cristian H. M. Souza
Digital and Cyber Forensics
article

Foremost-NG: An Open-Source Toolkit for Advanced File Carving and Analysis

Daniel Macêdo Batista, Cristian H. M. Souza
article en

Abstract

File carving and data recovery are critical tasks in digital forensics, incident response, and malware analysis. The original Foremost tool, while powerful, has long suffered the lack of updates and limited file formats. This paper introduces Foremost-NG, a community-driven fork that significantly refactors the core structure, adds new file-format parsers (including EVTX, script files, Mach-O, and ELF executables), and integrates with VirusTotal for on-the-fly threat intelligence. By modernizing the carving engine, decoupling format-specific handlers, and embedding an HTTP-based lookup for hash-based analysis, Foremost-NG delivers a robust, extensible platform for modern forensic workflows, as well as facilitates the inclusion of new file-formats.

Universidad San Pedro (PE), Chukyo University (JP)
Openalex Percentile: Top 64%
Digital and Cyber Forensics
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.