Foremost, designed by the United States Air Force Office of Special Investigations to aid in investigative work, offers a way of directly recovering data. Instead of looking through a file system based on its structure and then following file system references to a specific file, Foremost does a raw read of a block device to check for given criteria.

This is especially useful when you’ve created an image of a partition to check for the presence of illegal or unauthorized content. Another use is to restore small files from otherwise corrupted disk images.

No matter how you need to use it, the how-to article Recovering Data with Foremost is available on PCBurn and you can get the program from the source.