aeondave/foremost
offensive-tools/forensic/foremost/SKILL.md
Auth/lab ref: file carving from disk images, raw media, and damaged data; headers/footers, recovery workflow, evidence handling.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill foremostInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 3:46 AM105.7s1 file scanned
SKILL.md
- name:
- foremost
- description:
- Auth/lab ref: file carving from disk images, raw media, and damaged data; headers/footers, recovery workflow, evidence handling.
- compatibility:
- Linux, macOS, WSL; CLI-focused; works on raw files and images.
- author:
- AeonDave
- version:
- 1.0
Foremost
Header-footer carving for the moment when structure is gone but signatures remain.
When to use Foremost
Use Foremost when you need to:
- recover common file types from a raw image or dump
- triage a large blob quickly before deeper filesystem work
- carve likely loot from partially corrupted or unmounted data
Quick Start
# Carve common default types
foremost image.dd -o carve_out
# Restrict to selected types
foremost image.dd -t jpg,png,pdf,zip -o carve_out
Practical Notes
- Start with a narrow type set when you already know what you want; it reduces noise and disk churn.
- Foremost is great for first-pass recovery, but not a substitute for filesystem-aware tools.
- Review output names and offsets carefully; carved files often lose original metadata and paths.
Caveats
- Header/footer carving can recover fragments, duplicates, or false positives.
- Large images can produce a lot of junk if you carve every supported type.
- Filesystem context, timestamps, and original names usually do not survive.
Resources
No bundled scripts/, references/, or assets/.
Use the local config and man page for file-type signatures and custom carving behavior.
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026