| Author |
Message |
Arthur
Joined: 17 Oct 2007
Posts: 333
|
 Posted: Wed Jun 18, 2008 12:37 Post subject: Util that cuts byte 0-15 in .jpg's - any suggestions ??
|
|
I have case where i have recovered a lot's of JPG's. Problem is that i need to cut the beginning, byte 0-15, in all recovered files. Can't do batch processing with winhex.
Must be someone that have written such utility. Any suggestions ?
Arthur
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Wed Jun 18, 2008 13:28 Post subject:
|
|
I don't know such util.
But how this happen?
Where you take this 0-15 additional bytes?
|
|
|
Arthur
Joined: 17 Oct 2007
Posts: 333
|
|
Posted: Wed Jun 18, 2008 13:38 Post subject:
|
|
|
It's a cloned harddisk. NTFS. File headers starts at pos 0x010 in almost every file, except for those files residing at lower LBA's. Problems with translator usually results in shifts of atleast one whole sector, but in this case it is only 16 byte.. Might also be a virus that have added 16 byte to the beginning of those files, but the content differs.
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 20281
Flash-Extractor developer
|
|
Posted: Wed Jun 18, 2008 14:08 Post subject:
|
|
I know only WinHex
But its hand work
|
|
|
daniel
Joined: 04 Dec 2008
Posts: 117
Location: Poland, Skierniewice
|
|
Posted: Fri Aug 07, 2009 22:45 Post subject:
|
|
I think, that it's not difficult to write this util (e.g. in C++)  You can use free C++ compiler Dev-Cpp. It is very simply and friendly.
|
|
|
Mike
Joined: 16 Feb 2006
Posts: 205
Location: UK
|
|
Posted: Tue Aug 25, 2009 16:39 Post subject:
|
|
Its probably a bit late, but why dont you open the disk in WinHex and scan for JPG using byte offset instead of Sector offset ?
The problem with carving the file out is that you will be missing the last 16 bytes from each file which may corrupt the images slightly.
For the JPG entry in Winhex add the footer F8D9 <- from memory so check it is correct..
|
|
|
|
