3

I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ?

Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg)

Example:

file1
file2
data
file3

How do I know where file2 starts and file2 ends ?

Improve this question
2
  • Do you know the file types? You haven't given us much information, try to modify your question with more info.
    – 0xea
    May 2, 2014 at 18:13
  • 1
    Checkout binwalk.
    – 0xcaff
    May 2, 2014 at 21:04

3 Answers 3

Reset to default
3

Technically speaking what you're describing is an archive. If the archiving data structure was properly designed, in the header you must find either the start offset & the size or the start & end offsets of each file entry in the header, unless the files are all stored one after the other. In that latter case all you need to know is the start offset of each file because (suppose file0 comes first, followed by file1) file1's start offset is file0's end offset.

The example below shows the latter case :

  Offset00:file0
  Offset10:file1
  Offset30:file2
  Offset35:file3
Improve this answer
2

In addition to what yaspr said, i'd suggest looking for specification of those contained files. Most file formats have their size specified in the header somewhere. That would allow you to carve the file from the archive, without even knowing the archive structure.

This is what tools like scalpel are doing to carve files. They match the header to a known file type, and then lookup the file size in that header. Some file formats have specific endings which you could also use to carve them out (for example, every png file has IEND and the end).

Try your luck with scalpel and similar file carving tools.

Improve this answer
1
  • WAV (a RIFF format), BMP, and PNG have sufficient information in their headers to do just this. (Does JPEG as well? I believe it does not.) Anyway, knowing the supposed file size ties nicely in to yaspr's answer of how and where to locate the archive's own metadata.
    – Jongware
    May 2, 2014 at 22:47
1

Check out hachoir-subfile. Example from their repo. 

$ hachoir-subfile chiens.PPS
[+] Start search (828.5 KB)

[+] Found file at 0: Microsoft Office document
[+] Found file at 537 size=28449 (27.8 KB): JPEG picture: 433x300 pixels
[+] Found file at 29011 size=34761 (33.9 KB): JPEG picture: 433x300 pixels
[+] Found file at 63797 size=40326 (39.4 KB): JPEG picture: 433x300 pixels
[+] Found file at 104148 size=30641 (29.9 KB): JPEG picture: 433x300 pixels
[+] Found file at 134814 size=22782 (22.2 KB): JPEG picture: 384x325 pixels
[+] Found file at 157621 size=24744 (24.2 KB): JPEG picture: 443x313 pixels
[+] Found file at 182390 size=27241 (26.6 KB): JPEG picture: 443x290 pixels
[+] Found file at 209656 size=27407 (26.8 KB): JPEG picture: 443x336 pixels
[+] Found file at 237088 size=30088 (29.4 KB): JPEG picture: 388x336 pixels
[+] Found file at 267201 size=30239 (29.5 KB): JPEG picture: 366x336 pixels
[+] Found file at 297465 size=81634 (79.7 KB): JPEG picture: 630x472 pixels
[+] Found file at 379124 size=36142 (35.3 KB): JPEG picture: 599x432 pixels
[+] Found file at 415291 size=28801 (28.1 KB): JPEG picture: 443x303 pixels
[+] Found file at 444117 size=28283 (27.6 KB): JPEG picture: 433x300 pixels
[+] Found file at 472425 size=95913 (93.7 KB): PNG picture: 433x431x8
[+] Found file at 568363 size=219252 (214.1 KB): PNG picture: 532x390x8
[+] Found file at 811308 size=20644 (20.2 KB): Microsoft Windows Metafile (WMF) picture

ExtractSubFile can be used if you need to carve out the files.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.