foremost application

[mark...@gmail.com]

Hello,

Thank you for your advice in advance. In running this tool I have a
few questions about the conf file. One, I ran this on an image
searching for MS doc files. I got what appears to be duplicate
entires (00001040.doc & 00001040_1.doc) Why the duplicate entries.
One is 10 bytes and the other is 12,500 kb (which is the default in
foremost.conf).

The questions I have are the following. 1). What is the max in
foremost.conf? Can I change it to unlimited (eof). 2). I ran strings
on one of the files and it showed me what appeard a combination of
mulitiple files. Is it possible that it is not pulling out 1
specific .doc file. I did set the conf file to to pull only .doc
files. How can find the original name of the file? You can tell that
its not just a .doc file , even saw this (This program cannot be run
in DOS mode.) listed in the file. When I run file against the file I
get MS office document.

Thanks for your help.