aeondave/foremost
offensive-tools/forensic/foremost/SKILL.md
Foremost: file-carving utility for recovering files from disk images, raw dumps, and corrupted media based on headers and footers. Use when you need quick recovery of documents, archives, images, or executables from unstructured forensic data.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill foremostInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 9, 2026, 4:38 AM163.1s1 file scanned
SKILL.md
- name:
- foremost
- description:
- Foremost: file-carving utility for recovering files from disk images, raw dumps, and corrupted media based on headers and footers. Use when you need quick recovery of documents, archives, images, or executables from unstructured forensic data.
- compatibility:
- Linux, macOS, WSL; CLI-focused; works on raw files and images
- author:
- AeonDave
- version:
- 1.0
Foremost
Header-footer carving for the moment when structure is gone but signatures remain.
When to use Foremost
Use Foremost when you need to:
- recover common file types from a raw image or dump
- triage a large blob quickly before deeper filesystem work
- carve likely loot from partially corrupted or unmounted data
Quick Start
# Carve common default types
foremost image.dd -o carve_out
# Restrict to selected types
foremost image.dd -t jpg,png,pdf,zip -o carve_out
Practical Notes
- Start with a narrow type set when you already know what you want; it reduces noise and disk churn.
- Foremost is great for first-pass recovery, but not a substitute for filesystem-aware tools.
- Review output names and offsets carefully; carved files often lose original metadata and paths.
Caveats
- Header/footer carving can recover fragments, duplicates, or false positives.
- Large images can produce a lot of junk if you carve every supported type.
- Filesystem context, timestamps, and original names usually do not survive.
Resources
No bundled scripts/, references/, or assets/.
Use the local config and man page for file-type signatures and custom carving behavior.
Related Skills
aeondave/offensive-linux-role
data-ai
VerifiedTrustedCommunity
Scoped routing: Linux operator; hosts, sessions, users, services, packages, logs, containers, SSH, network paths, privilege evidence.
4SKILL.mdUpdated Jun 5, 2026
aeondave/ics-technique
development
VerifiedTrustedCommunity
Offensive methodology for ICS/OT/SCADA environments in authorized industrial penetration testing and red team operations. Use when assessing PLCs, RTUs, HMIs, engineering workstations, historians, or field devices running Modbus, DNP3, EtherNet/IP, S7comm/S7+, Profinet, IEC 60870-5-104, BACnet, or OPC-UA. Covers passive OT network enumeration, protocol-level device interrogation, PLC coil/register read-write attacks, HMI session exploitation, historian and engineering workstation compromise, and safe escalation rules for critical infrastructure scope. Does not cover: general IT network exploitation (network-technique), physical hardware interfaces UART/JTAG/SPI (hardware-technique), wireless sensor network attacks (wireless-technique), RF/SDR signal analysis (hardware-ctf or wireless-technique), or CTF-framed ICS lab tasks (ics-ctf).
4SKILL.mdUpdated Jun 2, 2026
aeondave/game-technique
tools
VerifiedTrustedCommunity
Offensive methodology for authorized game security assessments, game client security research, and game-adjacent penetration testing in real-world engagements. Use when assessing game clients for cheating vulnerabilities, testing anti-cheat effectiveness, auditing game server protocols for score manipulation or economic fraud, reverse engineering game DRM or license validation, analyzing game save file protection, or assessing game mod/plugin security. Covers: process memory scanning and manipulation (Cheat Engine methodology), game binary reversing for license and DRM bypass, game network protocol analysis and packet replay, anti-cheat mechanism analysis, save file format reversing and tampering, speed hack and value injection techniques. Does NOT cover: CTF game challenges (game-ctf), game engine source code auditing (web-exploit-technique or vuln-search-technique for the backend), or general binary exploitation (pwn-ctf or reversing-technique).
4SKILL.mdUpdated Jun 2, 2026
aeondave/hardware-technique
development
VerifiedTrustedCommunity
Auth assessment: hardware/embedded methodology; UART/JTAG/SWD/SPI/I2C, firmware extraction, boot/debug paths, embedded OS evidence.
4SKILL.mdUpdated Jun 2, 2026