Just wanted to let you guys know that I've been able to recover images from a Ricoh multi function device. Here is what I did
1- Created a DD image of the hard drive.
2- Swapped all the bytes in the image file.
3- Added the swapped image in FTK 3.
4- Performed data carving on the unallocated space (the whole drive was unallocated space).
5- Recovered 98 images.Voilà!
I know this is a question on an old post, but I was wondering how you "swapped all the bytes in the image file"? What did you use to swap them (i.e. hex editor, other program)? Could you please provide the details of your procedures? I am conducting some research on this topic and was intrigued by this forum. Thanks.
I agree, a little more detail would be great, maybe i can even do some testing on the Ricoh i have here in the office as well.
Greetings,
When I did this on another device, I used dd and the 'swab' option.
http//
-David
To swap all the bytes in the DD files, we programmed a small C++ application with a VB.Net GUI.
I did not know about the "swab" option in DD, thanks Kovar. I guess that's even easier…