linux forensic deleted files code example Example: linux forensic deleted files $ sudo foremost -i /dev/sdb1