0

I ran:

$> binwalk --dd='jpeg:jpg' file.bin

The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the images look like.

The file is about 8 years old and has been stored on probably 3 different drives since then. I can't imagine that bit rot would have gotten to it, but could that be a possibility? Is there anything else I can try?

Thanks.

Edit: FileJuicer worked perfectly!

  • Could you be overlooking that for some file types binwalk must guess where the data starts and/or end? – usr2564301 May 1 '18 at 11:31
  • what exactly is file.bin? how did you get it? – Igor Skochinsky May 2 '18 at 16:37
  • @IgorSkochinsky sorry that's just a placeholder. My file is a .private file created by the app, not .bin. – Justin Clark May 2 '18 at 20:24
  • what app? what is the file supposed to contain? – Igor Skochinsky May 2 '18 at 20:26
1

Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the size, and saves data starting from the point it found the header at. You may try to carve using photorec, but most probably it won't help either.

  • I see, thanks for the insight. Can photorec carve from an individual file? It seems that it will only scan partitions for deleted files, not extract images from WITHIN an existing file. I tried throwing my file on a USB drive and running photorec and as predicted it just grabbed old deleted files from the drive, nothing from within my file. – Justin Clark May 2 '18 at 20:26
  • you should use your file as if it's a drive image. – Anton Kukoba May 3 '18 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.