Foremost Date Carving and .tar.gz files

(Wow - my third post today where I am asking for help. This is the first time I decided to ask for help on the Suse Forums, up to know I’ve just been trying as best I can to help others. Guess I decided to unload today! Saving all my questions for a rainy day I suppose.)

While not a Suse specific question, I was wondering if anyone has used Foremost to recover files before. I have only used it twice, and it worked pretty well. My question though is that I want to specify .tar or tar.gz files to isolate those in the image file being analyzed. I can’t quite seem to figure out how to do this, and I am not sure of the best way to do so.

I don’t know how well suited the file headers and footers of .tar or .gz files are to recovery - I hope they are pretty good. Recovering these file types is mostly what I will need to use foremost fore.

Can anyone help me in figuring out what to add to my /etc/foremost.conf to zero in on either of these file types?

(The forums for Foremost at sourceforge are about as dead as you can get, so I am hoping there are some people here who have some experience with Foremost)

Thank you,
Pete

A better option would be to use the photorec utility from PhotoRec - CGSecurity
.tar and .gz filetypes are already defined in that package.