Menu ▾ ▴

#1 Tool does not work on large JPEGs

open
nobody
None
5
2006-12-06
2006-12-06
Rob Taft
No

I used a 'never been used' 64MB USB flash drive and copied digital camera pictures to it as well as other images.

I deleted the partition table on the drive.

I enabled all image types in the config.

After running foremost, this was the audit file:

Foremost version 1.3 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Wed Dec 6 10:14:21 2006
Invocation: ./foremost /dev/sdc
Output directory: /home/rtaft/Downloads/foremost-1.3/output
Configuration file: /home/rtaft/Downloads/foremost-1.3/foremost.conf
------------------------------------------------------------------
File: /dev/sdc
Start: Wed Dec 6 10:14:21 2006
Length: 62 MB (65536000 bytes)

Num Name (bs=512) Size File Offset Comment

0: 47684.jpg 20 KB 24414208
1: 48568.jpg 2 KB 24866816
2: 48584.jpg 2 KB 24875020
3: 48590.jpg 1 KB 24878092
4: 48593.jpg 2 KB 24879884
5: 48599.jpg 1 KB 24882700
6: 48602.jpg 2 KB 24884364
7: 48608.jpg 4 KB 24887308
8: 360.jpg 6 KB 184320
9: 1896.jpg 5 KB 970752
10: 3400.jpg 5 KB 1740800
11: 4832.jpg 6 KB 2473984
12: 6356.jpg 7 KB 3254272
13: 8260.jpg 8 KB 4229120
14: 12136.jpg 7 KB 6213632
15: 15256.jpg 7 KB 7811072
16: 17960.jpg 6 KB 9195520
17: 21224.jpg 1 KB 10866688
18: 23488.jpg 8 KB 12025856
19: 27324.jpg 8 KB 13989888
20: 32320.jpg 8 KB 16547840
21: 360.jpg 6 KB 184320
22: 365.jpg 3 KB 186956
23: 1896.jpg 5 KB 970752
24: 1901.jpg 3 KB 973388
25: 3400.jpg 5 KB 1740800
26: 3405.jpg 3 KB 1743436
27: 4832.jpg 6 KB 2473984
28: 4837.jpg 3 KB 2476620
29: 6356.jpg 7 KB 3254272
30: 6361.jpg 4 KB 3256908
31: 8260.jpg 8 KB 4229120
32: 8265.jpg 5 KB 4231756
33: 12136.jpg 7 KB 6213632
34: 12141.jpg 4 KB 6216268
35: 15256.jpg 7 KB 7811072
36: 15261.jpg 4 KB 7813708
37: 17960.jpg 6 KB 9195520
38: 17965.jpg 4 KB 9198156
39: 21224.jpg 1 KB 10866688
40: 21229.jpg 3 KB 10869324
41: 23488.jpg 8 KB 12025856
42: 23493.jpg 5 KB 12028492
43: 27324.jpg 8 KB 13989888
44: 27327.jpg 6 KB 13991467
45: 27329.jpg 5 KB 13992524
46: 32320.jpg 8 KB 16547840
47: 32325.jpg 6 KB 16550476
48: 36797.jpg 5 MB 18840140
49: 47684.jpg 20 KB 24414208
50: 48553.jpg 9 KB 24859398
51: 48568.jpg 2 KB 24866816
52: 48584.jpg 2 KB 24875020
53: 48590.jpg 1 KB 24878092
54: 48593.jpg 2 KB 24879884
55: 48599.jpg 1 KB 24882700
56: 48602.jpg 2 KB 24884364
57: 48608.jpg 4 KB 24887308
58: 9139.png 195 KB 4679596
59: 17000.png 195 KB 8704252
60: 31356.png 195 KB 16054524
61: 33630.png 195 KB 17218849
62: 34546.png 195 KB 17687581
63: 36530.png 195 KB 18703656
64: 36792.png 195 KB 18837864
65: 48384.png 195 KB 24772609
Finish: Wed Dec 6 10:14:27 2006

66 FILES EXTRACTED

jpg:= 8
jpg:= 13
jpg:= 37
png:= 8
------------------------------------------------------------------

Foremost finished at Wed Dec 6 10:14:27 2006

Using jpeg-recovery I got the correct results:

-rw-r--r-- 1 rtaft rtaft 785149 Dec 6 10:10 01.jpg
-rw-r--r-- 1 rtaft rtaft 769588 Dec 6 10:10 02.jpg
-rw-r--r-- 1 rtaft rtaft 732877 Dec 6 10:10 03.jpg
-rw-r--r-- 1 rtaft rtaft 778636 Dec 6 10:10 04.jpg
-rw-r--r-- 1 rtaft rtaft 973729 Dec 6 10:10 05.jpg
-rw-r--r-- 1 rtaft rtaft 1983033 Dec 6 10:10 06.jpg
-rw-r--r-- 1 rtaft rtaft 1596769 Dec 6 10:10 07.jpg
-rw-r--r-- 1 rtaft rtaft 1383727 Dec 6 10:10 08.jpg
-rw-r--r-- 1 rtaft rtaft 1671084 Dec 6 10:10 09.jpg
-rw-r--r-- 1 rtaft rtaft 1157851 Dec 6 10:10 10.jpg
-rw-r--r-- 1 rtaft rtaft 1963379 Dec 6 10:10 11.jpg
-rw-r--r-- 1 rtaft rtaft 2556605 Dec 6 10:10 12.jpg
-rw-r--r-- 1 rtaft rtaft 2287684 Dec 6 10:10 13.jpg
-rw-r--r-- 1 rtaft rtaft 21409 Dec 6 10:10 14.jpg
-rw-r--r-- 1 rtaft rtaft 2178 Dec 6 10:10 15.jpg
-rw-r--r-- 1 rtaft rtaft 2978 Dec 6 10:10 16.jpg
-rw-r--r-- 1 rtaft rtaft 1673 Dec 6 10:10 17.jpg
-rw-r--r-- 1 rtaft rtaft 1596 Dec 6 10:10 18.jpg
-rw-r--r-- 1 rtaft rtaft 2838 Dec 6 10:10 19.jpg
-rw-r--r-- 1 rtaft rtaft 4400 Dec 6 10:10 20.jpg

There were only 2 png's, foremost found 8. Some of the JPEGs recovered were simply a jpeg of the path of the jpeg it was creating. Any images that it actually recovered were significantly smaller in size (less than 100x100, should be closer to 2580 x 1932). Only 1 jpeg appeared to be correctly parsed. The bitmaps were parsed as jpegs (idk how that worked) and were also significantly smaller (jpeg-recovery did this as well).

Discussion

  • Rob Taft

    Rob Taft - 2006-12-06

    Logged In: YES
    user_id=588658
    Originator: YES

    apparently I didn't follow directions, I used the config file instead of using -t for the image files.

     

  • Nobody/Anonymous

    Nobody/Anonymous - 2013-04-12

    Adore to draw this are christian louboutin shoes comfortable to wear due to jean material furthermore dressed in dark-colored ! These are generally incredible to bring to be hired anything like me due to being on this little feet the entire 7 day period to provide a beauty shop!!! Furthermore have got the Baily pulls and yet those of you are christian louboutin shoes comfortable to wear happen to be totally Outstanding in my situation! Ideal if you wish to become fantastic and yet investigate snazzy in the mean time ! ? !! Merely tidy these with another stormy washcloth and use water-repellent product once a month . works out brill. Christian Louboutin Men http://www.cheapchristianlouboutinman.com/