I have now made some tests with EnCase 6 and it performed pretty much the same as Scalpel did. This made me think of why EnCase also did perform this badly.
I've come up to that it's probably the footers "fault". Because the footer is short (FF D9) it will produce a false hit. When using a header/footer based file carver, the carver may detect the footer signature before the end of the actual file, which will result in a corrupt file and only viewable thumbnails.
I made a quick search of the footer signature in FTK imager and indeed i found it in multiple places in the jpgs.
Can somebody confirm my theory or am i way off?
I have seen valid JPEGs with 3 images - thumbnail, small image and full image. Each image will end with 0xff 0xd9.
I think carving is best based on file start, and then verification to find the end, rather than a fixed end flag.
Consider when the image is fragmented, the file will not end, but a new one may well start. Concentrate on the new one and truncate the partial one..
For many files the length is not too important if it is too long.
I have now made some tests with EnCase 6 and it performed pretty much the same as Scalpel did. This made me think of why EnCase also did perform this badly.
I've come up to that it's probably the footers "fault". Because the footer is short (FF D9) it will produce a false hit. When using a header/footer based file carver, the carver may detect the footer signature before the end of the actual file, which will result in a corrupt file and only viewable thumbnails.
I made a quick search of the footer signature in FTK imager and indeed i found it in multiple places in the jpgs.Can somebody confirm my theory or am i way off?
It's not the footers fault, it's the basic approach scalpel uses; last time I checked Encase as well. It only looks at the beginning an some imaginary unique identifier of an end (footer). Whereas the thumbnail is also a JPEG and the carver does not take that into account. There are far better ways to carve, especially JPEGs ; e.g. adroit photo recovery. Also see DFRWS 2006 and 2007 carving challenge results.
Well, this is frustrating. EnCase's File Finder script used to have no problems whatsoever dealing with thumbnails.
x
Jon