There is an issue with the foremost software that prevents it from reading location names with spaces. In these instances, it simply ignores the specified location and places the output in some unknown location. Example:
sudo foremost -c "/home/[user]/my_signature_configurations.conf" -i /dev/sdb -o "/media/[user]/[External drive with spaces in name]/output" -T
Foremost works as intended when an external drive with no spaces in the name is used. It will not interpret underscores as spaces. It simply cannot process spaces and instead places the files in some unknown location.
I verified that the files were not being placed on the external drive and were instead being placed somewhere on my internal storage drive, but they cannot be located through a file search. I have looked all over the drive and cannot identify where the files are. There is just 15 GB of "dark data" hidden somewhere, apparently in some hidden folder. The files are not in root.
Foremost does not have its own output directory that it defaults to if an output is not specified. In those cases, it is designed to output the files in whatever directory it was launched from - but I have verified that the files are not there! Any clue where these files are on my drive, or how I could go about identifying them?
For example, how can I do a recursive search including all hidden and root directories to only identify files and folders that were created within the last 24 hours?
