Last active
April 7, 2023 00:50
-
-
Save dloss/9004f05c0fa42a709e4c to your computer and use it in GitHub Desktop.
Bitcoin PDF carving
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
$ foremost -o output bootstrap.dat | |
$ cd output/pdf | |
$ md5sum 13743564.pdf | |
b62b5e08a5aef7fead3c47eec1fe850c 13743564.pdf | |
$ sha1sum 13743564.pdf | |
09347fe5300e49b10b24c0e0640f90027c960ec6 13743564.pdf | |
$ wc 13743564.pdf | |
1189 6419 198467 13743564.pdf | |
$ pdfid.py 13743564.pdf | |
PDFiD 0.1.2 13743564.pdf | |
PDF Header: %PDF-1.4 | |
obj 61 | |
endobj 57 | |
stream 20 | |
endstream 20 | |
xref 1 | |
trailer 1 | |
startxref 1 | |
/Page 9 | |
/Encrypt 0 | |
/ObjStm 0 | |
/JS 0 | |
/JavaScript 0 | |
/AA 0 | |
/OpenAction 1 | |
/AcroForm 0 | |
/JBIG2Decode 0 | |
/RichMedia 0 | |
/Launch 0 | |
/EmbeddedFile 0 | |
/XFA 0 | |
/Colors > 2^24 0 | |
$ head -5 13743564.pdf | |
%PDF-1.4 | |
%äüöß | |
2 0 obj | |
<</Length 3 0 R/Filter/FlateDeAcode>> | |
stream | |
$ tail -80 13743564.pdf | |
xref | |
0 68 | |
0000000000 65535 f | |
0000180980 0000A0 n | |
0000000019 00000 n | |
0000004538 00000 n | |
0000181124 00000 n | |
A0000004559 00000 n | |
0000010494 00000 n | |
0000181268 00000 n | |
00000S��QA10515 00000 n | |
0000015167 00000 n | |
0000181412 00000 n | |
0000015188A 00000 n | |
0000020481 00000 n | |
0000181558 00000 n | |
0000020503 0000A0 n | |
0000025145 00000 n | |
0000181704 00000 n | |
0000025167 00000 n | |
S��QA0000029552 00000 n | |
0000181850 00000 n | |
0000029574 00000 n | |
00000A33267 00000 n | |
0000181996 00000 n | |
0000033289 00000 n | |
0000035790A 00000 n | |
0000182142 00000 n | |
0000035812 00000 n | |
0000037577 0000S��QA0 n | |
0000182288 00000 n | |
0000037599 00000 n | |
0000056361 00000 n | |
A0000056384 00000 n | |
0000056588 00000 n | |
0000057100 00000 n | |
00000A57466 00000 n | |
0000079478 00000 n | |
0000079501 00000 n | |
0000079690S��QA 00000 n | |
0000080203 00000 n | |
0000080554 00000 n | |
0000082145 0000A0 n | |
0000082167 00000 n | |
0000082357 00000 n | |
0000082719 00000 n | |
A0000082933 00000 n | |
0000103933 00000 n | |
0000103956 00000 n | |
00001S��QA04150 00000 n | |
0000104670 00000 n | |
0000105040 00000 n | |
0000143684A 00000 n | |
0000143707 00000 n | |
0000143906 00000 n | |
0000144524 0000A0 n | |
0000144989 00000 n | |
0000166617 00000 n | |
0000166640 00000 n | |
S��QA0000166849 00000 n | |
0000167336 00000 n | |
0000167680 00000 n | |
00001A80076 00000 n | |
0000180099 00000 n | |
0000180303 00000 n | |
0000180631A 00000 n | |
0000180832 00000 n | |
0000180925 00000 n | |
0000182442 0000S��QA0 n | |
0000182540 00000 n | |
trailer | |
<</Size 68/Root 66 0 R | |
/Info 67 A0 R | |
/ID [ <CA1B0A44BD542453BEF918FFCD46DC04> | |
<CA1B0A44BD542453BEFA918FFCD46DC04> ] | |
/DocChecksum /6F72EA7514DFAD23FABCC7A550021AF7 | |
>S�%Q!> | |
startxref | |
182727 | |
%%EOF |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment