Hey,
1. I'm noob, but I've spent 20 hours to repair this files
2. I tried almost all what I could find on internet
3. I have few jpeg there - for example, for reference, i have one is corrupted and another is not, want to know if corrupted one possible to repair as well?
4. I cannot figure it out
https://drive.google.com/file/d/1q5wnUBVQ2otLA6HqYBfuMVLgAEprlOnk/view
5. I used theses sites as references:
HEX editor online
HEX to image online
https://codepen.io/abdhass/full/jdRNdj
PNG - File contents analysis
"https://asecuritysite.com/forensics/png?file=%2Flog%2Fbasn0g01.png"
JPEG (.jpg) and PNG (.png) images are completely different formats, so techniques and tools are completely different.
BUT the two "2017-Fashion-casual-streetwear-Men-s-Printed-New-York-City-NYC-Graphic-Design-T-Shirt-Men.jpg" and "2017-Fashion-casual-streetwear-Men-s-Printed-New-York-City-NYC-Graphic-Design-T-Shirt-Menn.jpg" are - respectively - a "good" .jpg and "an assembly of bytes".
There is simply no way the second can be "recovered" maybe this latter is encoded or encrypted (without compression as the size is the same).
I.e. the second image is either "something else" (like a filesystem issue pointing to a wrong extent on disk) or the effect of some kind og manipulation (encoding or encrypting).
If you look at design11.png in a hex editor, you will see how there are snippets of text - here and there - related to some internet navigation (likely made with Firefox) the file version info from a Windows 10 system file (apisetstub.dll) and various chunks that appear like base64 encoded data.
The above make me think of a filesytem corruption issue (very probably on a highly fragmented volume), the sectors retrieved for the file simply belong to "something else".
jaclaz
Repair is only possible if the data is from the correct file. The JPEG files do not have any type of header which make it hard.
I would like to know why you think they have been corrupted. Have they been recovered from somewhere? If so what was the original disk format (NTFS, Reiser or what).
If a FAT32 disk, many recovery programs do not support that the fact the high part of the cluster address is often zeroed and so has to be determined by other means. This means that data is taken from the wrong address.
I agree with jaclaz that encryption is possible - there is no obvious pattern to the data.
If it was deletion, try and obtain the original data source, and not the 'recovered' files.
Â
I agree with jaclaz that encryption is possible - there is no obvious pattern to the data.Â
But I have to disagree. :w00t:
The comparison between the two .jpg's could lead to either an encryption (or encoding) of the file or to some kind of filesytem corruption, but the .png surely cannot be the former and must be a case of fileystem corruption.
It would IMHO be unlikely that on a same volume there are both, and even if they both coexist, that out of two "random" samples one can be explained by both and the other by only one .
So it is more likely that the base issue is still the same (filesystem corruption/wrong data fetched for the files) with the first "bad pointer" retrieving (by pure chance) a segment of an encrypted or encoded file and the second "bad pointer" retrieving (again by pure chance) a miscellaneous assortment of various data from several different files.
jaclazÂ