I am trying to recover one file, whose name I know, that I accidentally deleted using
rm. I am using
foremost and specifying the file extension (
sudo foremost -w -t zip -i /dev/sdc1 -o /recoverydir
/dev/sdc1 is the filesystem where the file is located (which I have already unmounted) and
recoverydir is the directory where I am saving recovered files to. With the command above the option
-w only gives an audit but does not recover anything.
The problem is that there are way too many files that match the criteria and I would like to narrow it down to the file's exact name or even the approximate size, which I know.
How can this be done with
foremost or another tool?