Skip to content

Instantly share code, notes, and snippets.

@dloss
Last active April 7, 2023 00:50
Show Gist options
  • Save dloss/9004f05c0fa42a709e4c to your computer and use it in GitHub Desktop.
Save dloss/9004f05c0fa42a709e4c to your computer and use it in GitHub Desktop.
Bitcoin PDF carving
$ foremost -o output bootstrap.dat
$ cd output/pdf
$ md5sum 13743564.pdf
b62b5e08a5aef7fead3c47eec1fe850c 13743564.pdf
$ sha1sum 13743564.pdf
09347fe5300e49b10b24c0e0640f90027c960ec6 13743564.pdf
$ wc 13743564.pdf
1189 6419 198467 13743564.pdf
$ pdfid.py 13743564.pdf
PDFiD 0.1.2 13743564.pdf
PDF Header: %PDF-1.4
obj 61
endobj 57
stream 20
endstream 20
xref 1
trailer 1
startxref 1
/Page 9
/Encrypt 0
/ObjStm 0
/JS 0
/JavaScript 0
/AA 0
/OpenAction 1
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 0
/EmbeddedFile 0
/XFA 0
/Colors > 2^24 0
$ head -5 13743564.pdf
%PDF-1.4
%äüöß
2 0 obj
<</Length 3 0 R/Filter/FlateDeAcode>>
stream
$ tail -80 13743564.pdf
xref
0 68
0000000000 65535 f
0000180980 0000A0 n
0000000019 00000 n
0000004538 00000 n
0000181124 00000 n
A0000004559 00000 n
0000010494 00000 n
0000181268 00000 n
00000S��QA10515 00000 n
0000015167 00000 n
0000181412 00000 n
0000015188A 00000 n
0000020481 00000 n
0000181558 00000 n
0000020503 0000A0 n
0000025145 00000 n
0000181704 00000 n
0000025167 00000 n
S��QA0000029552 00000 n
0000181850 00000 n
0000029574 00000 n
00000A33267 00000 n
0000181996 00000 n
0000033289 00000 n
0000035790A 00000 n
0000182142 00000 n
0000035812 00000 n
0000037577 0000S��QA0 n
0000182288 00000 n
0000037599 00000 n
0000056361 00000 n
A0000056384 00000 n
0000056588 00000 n
0000057100 00000 n
00000A57466 00000 n
0000079478 00000 n
0000079501 00000 n
0000079690S��QA 00000 n
0000080203 00000 n
0000080554 00000 n
0000082145 0000A0 n
0000082167 00000 n
0000082357 00000 n
0000082719 00000 n
A0000082933 00000 n
0000103933 00000 n
0000103956 00000 n
00001S��QA04150 00000 n
0000104670 00000 n
0000105040 00000 n
0000143684A 00000 n
0000143707 00000 n
0000143906 00000 n
0000144524 0000A0 n
0000144989 00000 n
0000166617 00000 n
0000166640 00000 n
S��QA0000166849 00000 n
0000167336 00000 n
0000167680 00000 n
00001A80076 00000 n
0000180099 00000 n
0000180303 00000 n
0000180631A 00000 n
0000180832 00000 n
0000180925 00000 n
0000182442 0000S��QA0 n
0000182540 00000 n
trailer
<</Size 68/Root 66 0 R
/Info 67 A0 R
/ID [ <CA1B0A44BD542453BEF918FFCD46DC04>
<CA1B0A44BD542453BEFA918FFCD46DC04> ]
/DocChecksum /6F72EA7514DFAD23FABCC7A550021AF7
>S�%Q!>
startxref
182727
%%EOF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment