Hello,
I am using foremost to pull out images JPGs from an image. The output is listing the images as expected, but some have an odd naming convention. There will be two files with the given name 01292685.jpg and 01292685_1.jpg. I understand that the names are assigned by foremost. When I look at the files they are completely different, (md5, size, and are just different when you view them.)
Can anyone explain this to me?
Thanks,
Mark
Just an idea …
Here is what I found in foremost's man page
-b number
Allows you to specify the block size used in foremost.
This is relevant for file naming and quick searches.
The default is 512. ie. foremost -b 1024 image.dd
Would that mean that images are numbered after the block / cluster they come from ?
Then maybe if more than one file is found in a block / cluster, the second file would be named "number_1.jpg" ?
This would require just a little testing, which I can't do right now …