Skip to content

Instantly share code, notes, and snippets.

@PatrickKratsch
Last active August 29, 2015 14:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save PatrickKratsch/b11cdd9cab31e451f49d to your computer and use it in GitHub Desktop.
Save PatrickKratsch/b11cdd9cab31e451f49d to your computer and use it in GitHub Desktop.
/**
* recover.c
*
* Computer Science 50
* Problem Set 5
*
* Recovers JPEGs from a forensic image.
*
* edited by Patrick
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include "bmp.h"
int main(void)
{
// opens card.raw
FILE* inptr = fopen("card.raw", "r");
if (inptr == NULL)
{
printf("Could not open card.raw");
return 1;
}
int counter = 1;
char title[7];
while (!feof(inptr)) // stop executing once EOF is reached
{
BYTE JPEG[512];
// READ 512 BYTES INTO A BUFFER
if (fread(&JPEG, sizeof(BYTE), 512, inptr) != 512)
{
break;
}
else if (JPEG[0] == 0xff && JPEG[1] == 0xd8 && JPEG[2] == 0xff)
{
if (JPEG[3] == 0xe0 || JPEG[3] == 0xe1)
{
// only do this once jpeg is found
sprintf(title, "%d.jpg", counter);
// update counter
counter++;
// only do this once jpeg is found
FILE* img = fopen(title, "w");
fwrite(&JPEG, sizeof(BYTE), 512, img);
fclose(img);
}
}
// only executes once first jpeg is found
else if (counter > 1)
{
// open existing file
FILE* img = fopen(title, "a");
// write to existing jpeg till next jpeg found
fwrite(&JPEG, sizeof(BYTE), 512, img);
fclose(img);
}
}
// closes card.raw
fclose(inptr);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment