Results 1 to 3 of 3

Thread: viewing recovered image files

  1. #1
    Junior Member
    Join Date
    Mar 2006
    Posts
    2

    viewing recovered image files

    Hello

    I'm currently doing a computer forensics unit at uni we have been given some floppy disk images to play with. They have supplied us with helix but for this task I decided to use Suse.

    Anyway I have extracted various files including gifs ,jpegs and pngs using foremost. I'm able to view the gifs using eog or gimp but I can not open the jpegs or the pngs both programs throw fatal exceptions when I attempt to.

    Has anyone encountered this? Anyone know of a work around or program that might solve this problem?


    Thanks

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    If you are trying to open them as images based on the file extension you might be going down the wrong path.... Which a forensics chap shouldn't be doing...

    I can't remember what it is called but there is a *nix program that examines files regardless of extension and tells you what they actuallyy are... Then maybe you can examine them in the appropriate fashion...

    Always think broadly if you are trying to find something... People will try to hide stuff in all sorts of ways... renaming them is trivial... But it may have caught you out...
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    Junior Member
    Join Date
    Mar 2006
    Posts
    2
    lol yeah I must admit I hadn't thought of that .... very new to this forensics stuff.

    I'll try it from a different angle.

    Thanks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •