±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34072
New Yesterday: 2 Visitors: 151

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

How do i Extract a jpg from an unallocated directory

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

How do i Extract a jpg from an unallocated directory

Post Posted: Thu Jun 07, 2018 6:40 am

I have a project for school, a phishing case we need to solve. We got a laptop from which we extracted an E01 image. After analysing the image in autopsy, i came across an unallocated directory. But because of the interesting name i performed "string -td" on the image into a txt file. After that i grepped the name of the unallocated directory and found 3 jpg's within it. My question now is how do i extract or view these jpg's?  

LukasRijn
Newbie
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Thu Jun 07, 2018 7:01 am

Which filesystem?

If it is a school exercise, most probably the single JPEG images are contiguous, so you need to find the start and end of each and then dd it to a new file:

www.file-recovery.com/...format.htm

Autopsy/Sleuthkit have carving capabilities:
wiki.sleuthkit.org/ind...le=Carving

But of course there are tens of softwares capable of doing this kind of automated carving for a given filetype (in this case it is more "data recovery" than "digital forensics").


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Thu Jun 07, 2018 7:59 am

Another free tool that works pretty well is called "photorec" (photo recovery). It also works well on non-image file types. www.cgsecurity.org/wiki/PhotoRec  

jpickens
Senior Member
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Thu Jun 07, 2018 11:00 am

Thanks for the help i will defenitly try it. i tried "icat" ,after i found the inode, into a jpg file but it turned out it wasn't a jpg but something else.  

LukasRijn
Newbie
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Wed Jun 13, 2018 10:42 am

Search for the header and footer of an jpg file. Extract anything between.

Send me a PM. i am from Belgium
Regards,
Etienne  

etiennem
Newbie
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Wed Jun 13, 2018 10:48 am

- etiennem
Search for the header and footer of an jpg file. Extract anything between.


Really? Question

Guess what exactly is on the given reference?
www.file-recovery.com/...format.htm


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: How do i Extract a jpg from an unallocated directory

Post Posted: Wed Jun 13, 2018 11:40 am

Oeps - I didn't check the URL.
I use Garry Kessler website to extract all kinds of files in the dd image. The search can also be done in a hexviewer.
Searching for the footer or trailer is even not necessary; just select a large part and add the appropriate footer at the end of the file.
www.garykessler.net/li..._sigs.html  

etiennem
Newbie
 
 

Page 1 of 2
Go to page 1, 2  Next