Just wanted to follow up on this. Attached is the patch I used to recover JPEG photographs. I changed the maximum file size to 5 MB. Too large a number would have caused too-large JPEG files with multiple pictures concatenated together; too small a number would have missed certain large files.
On Mon, Jun 27, 2011 at 9:31 PM, Isaac Schemm <[email protected]> wrote: > On second thought, this patch won't work. It generates JPEG files that > are much too large (on the scale of 107 MB!) > Is there a way to define a footer as being "FF D9" unless it is "FF D9 > ? ? ? ? http" or "FF D9 ? ? ? ? Phot" ? That would probably solve my > problem. Or I could just change the maximum file size, but I doubt > that's a robust solution. > > On Mon, Jun 27, 2011 at 1:55 PM, Isaac Schemm <[email protected]> wrote: >> Package: scalpel >> Version: 1.60-1 >> Severity: important >> Tags: patch >> >> The configuration in scalpel.conf for finding JPEG files is flawed. It >> searches for a file with a header "FF D8 FF E0 00 10" and a footer "FF D9". >> However, through examining files from a digital camera and files made with >> GIMP, I have noticed that the fourth, fifth and sixth bytes vary between >> images. This causes scalpel to miss many JPEG files. >> I have also seen JPEG files (from the digital camera) that contain "FF D9" >> multiple times, not just at the end of the file. This causes scalpel to >> truncate the file prematurely, making it unviewable. >> A patch is included that makes scalpel's JPEG-detection behavior more >> reliable. >> >> -- System Information: >> Debian Release: wheezy/sid >> APT prefers testing >> APT policy: (500, 'testing') >> Architecture: amd64 (x86_64) >> >> Kernel: Linux 2.6.38-6.dmz.1-liquorix-amd64 (SMP w/4 CPU cores; PREEMPT) >> Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) >> Shell: /bin/sh linked to /bin/dash >> >> Versions of packages scalpel depends on: >> ii libc6 2.13-7 Embedded GNU C Library: Shared >> lib >> >> scalpel recommends no packages. >> >> scalpel suggests no packages. >> >> -- Configuration Files: >> /etc/scalpel/scalpel.conf changed [not included] >> >> -- no debconf information >> >
scalpel.patch
Description: Binary data
