Download Version 2 - Linux LEO

v. 3.78 The Law Enforcement and Forensic Examiner's Introduction to Linux This exercise starts with the assumption that we are familiar with standard file headers. Since we will be searching for a standard JPEG image within the data chunk, we will start with the stipulation that the JPEG header begins with hex ffd8 with a six­byte offset to the string “JFIF”. The end of the standard JPEG is marked by hex ffd9.
Let’s go ahead with step 1: Using xxd, we pipe the output of our image_carve.raw file to grep and look for the start of the JPEG9:
root@rock:~# xxd image_carve.raw | grep ffd8
00052a0: b4f1 559c ffd8 ffe0 0010 4a46 4946 0001
..U.......JFIF..
As the output shows, using grep we’ve found the pattern “ffd8” near the string “JFIF”. The start of a standard JPEG file header has been found. The offset (in hex) for the beginning of this line of xxd output is 00052a0. Now we can calculate the byte offset in decimal. For this we will use the bc command. bc is a command line “calculator”, useful for conversions and calculations. It can be used either interactively or take piped input. In this case we will echo the hex offset to bc, first telling it that the value is in base 16. bc will return the decimal value.
root@rock:~# echo "ibase=16;00052A0" | bc
21152
It’s important that you use uppercase letters in the hex value. Note that this is NOT the start of the JPEG, just the start of the line in xxd’s output. The “ffd8” string is actually located another 4 bytes farther into that line of output. So we add 4 to the start of the line. Our offset is now 21156. We have found and calculated the start of the JPEG image in our data chunk.
Now it’s time to find the end of the file. Since we already know where the JPEG starts, we will start our search for the end of the file from that point. Again using xxd and grep we search for the string:
root@rock:~# xxd -s 21156 image_carve.raw | grep ffd9
0006c74: ffd9 d175 650b ce68 4543 0bf5 6705 a73c ...ue..hEC..g..<
The perceptive among you will notice that this is a “perfect world” situation. There are a number of variables that can make this operation more difficult. The grep command can be adjusted for many situations using a complex regular expression (outside the scope of this document). 9
Barry J. Grundy
92