1

I ran:

$> binwalk --dd='jpeg:jpg' file.bin

The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the images look like.

The file is about 8 years old and has been stored on probably 3 different drives since then. I can't imagine that bit rot would have gotten to it, but could that be a possibility? Is there anything else I can try?

Thanks.

Edit: FileJuicer worked perfectly!

4
  • Could you be overlooking that for some file types binwalk must guess where the data starts and/or end?
    – Jongware
    May 1, 2018 at 11:31
  • what exactly is file.bin? how did you get it?
    – Igor Skochinsky
    May 2, 2018 at 16:37
  • @IgorSkochinsky sorry that's just a placeholder. My file is a .private file created by the app, not .bin. May 2, 2018 at 20:24
  • what app? what is the file supposed to contain?
    – Igor Skochinsky
    May 2, 2018 at 20:26

1 Answer 1

4

Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the size, and saves data starting from the point it found the header at. You may try to carve using photorec, but most probably it won't help either.

2
  • I see, thanks for the insight. Can photorec carve from an individual file? It seems that it will only scan partitions for deleted files, not extract images from WITHIN an existing file. I tried throwing my file on a USB drive and running photorec and as predicted it just grabbed old deleted files from the drive, nothing from within my file. May 2, 2018 at 20:26
  • you should use your file as if it's a drive image. May 3, 2018 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.