±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Jobs
±Latest Webinars
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Really?
Guess what exactly is on the given reference?
www.file-recovery.com/...format.htm
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
How do i Extract a jpg from an unallocated directory
Go to page 1, 2 NextHow do i Extract a jpg from an unallocated directory
Posted: Thu Jun 07, 2018 6:40 am
I have a project for school, a phishing case we need to solve. We got a laptop from which we extracted an E01 image. After analysing the image in autopsy, i came across an unallocated directory. But because of the interesting name i performed "string -td" on the image into a txt file. After that i grepped the name of the unallocated directory and found 3 jpg's within it. My question now is how do i extract or view these jpg's?
-
LukasRijn - Newbie
Re: How do i Extract a jpg from an unallocated directory
Posted: Thu Jun 07, 2018 7:01 am
Which filesystem?
If it is a school exercise, most probably the single JPEG images are contiguous, so you need to find the start and end of each and then dd it to a new file:
www.file-recovery.com/...format.htm
Autopsy/Sleuthkit have carving capabilities:
wiki.sleuthkit.org/ind...le=Carving
But of course there are tens of softwares capable of doing this kind of automated carving for a given filetype (in this case it is more "data recovery" than "digital forensics").
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
If it is a school exercise, most probably the single JPEG images are contiguous, so you need to find the start and end of each and then dd it to a new file:
www.file-recovery.com/...format.htm
Autopsy/Sleuthkit have carving capabilities:
wiki.sleuthkit.org/ind...le=Carving
But of course there are tens of softwares capable of doing this kind of automated carving for a given filetype (in this case it is more "data recovery" than "digital forensics").
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-
jaclaz - Senior Member
Re: How do i Extract a jpg from an unallocated directory
Posted: Thu Jun 07, 2018 7:59 am
Another free tool that works pretty well is called "photorec" (photo recovery). It also works well on non-image file types. www.cgsecurity.org/wiki/PhotoRec
-
jpickens - Senior Member
Re: How do i Extract a jpg from an unallocated directory
Posted: Thu Jun 07, 2018 11:00 am
Thanks for the help i will defenitly try it. i tried "icat" ,after i found the inode, into a jpg file but it turned out it wasn't a jpg but something else.
-
LukasRijn - Newbie
Re: How do i Extract a jpg from an unallocated directory
Posted: Wed Jun 13, 2018 10:42 am
Search for the header and footer of an jpg file. Extract anything between.
Send me a PM. i am from Belgium
Regards,
Etienne
Send me a PM. i am from Belgium
Regards,
Etienne
-
etiennem - Newbie
Re: How do i Extract a jpg from an unallocated directory
Posted: Wed Jun 13, 2018 10:48 am
- etiennemSearch for the header and footer of an jpg file. Extract anything between.
Really?

Guess what exactly is on the given reference?
www.file-recovery.com/...format.htm
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-
jaclaz - Senior Member
Re: How do i Extract a jpg from an unallocated directory
Posted: Wed Jun 13, 2018 11:40 am
Oeps - I didn't check the URL.
I use Garry Kessler website to extract all kinds of files in the dd image. The search can also be done in a hexviewer.
Searching for the footer or trailer is even not necessary; just select a large part and add the appropriate footer at the end of the file.
www.garykessler.net/li..._sigs.html
I use Garry Kessler website to extract all kinds of files in the dd image. The search can also be done in a hexviewer.
Searching for the footer or trailer is even not necessary; just select a large part and add the appropriate footer at the end of the file.
www.garykessler.net/li..._sigs.html
-
etiennem - Newbie