I have a project for school, a phishing case we need to solve. We got a laptop from which we extracted an E01 image. After analysing the image in autopsy, i came across an unallocated directory. But because of the interesting name i performed "string -td" on the image into a txt file. After that i grepped the name of the unallocated directory and found 3 jpg's within it. My question now is how do i extract or view these jpg's?  

Which filesystem?

If it is a school exercise, most probably the single JPEG images are contiguous, so you need to find the start and end of each and then dd it to a new file:

www.file-recovery.com/...format.htm

Autopsy/Sleuthkit have carving capabilities:
wiki.sleuthkit.org/ind...le=Carving

But of course there are tens of softwares capable of doing this kind of automated carving for a given filetype (in this case it is more "data recovery" than "digital forensics").


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

Another free tool that works pretty well is called "photorec" (photo recovery). It also works well on non-image file types. www.cgsecurity.org/wiki/PhotoRec  

Thanks for the help i will defenitly try it. i tried "icat" ,after i found the inode, into a jpg file but it turned out it wasn't a jpg but something else.  

Search for the header and footer of an jpg file. Extract anything between.

Send me a PM. i am from Belgium
Regards,
Etienne  

- etiennem

Search for the header and footer of an jpg file. Extract anything between.

Really?

Guess what exactly is on the given reference?
www.file-recovery.com/...format.htm


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

Oeps - I didn't check the URL.
I use Garry Kessler website to extract all kinds of files in the dd image. The search can also be done in a hexviewer.
Searching for the footer or trailer is even not necessary; just select a large part and add the appropriate footer at the end of the file.
www.garykessler.net/li..._sigs.html