View Full Version : Computer forensic
itsashnow
Sep 8, 2009, 10:40 AM
After recovering some pics, If a JPEG image is only 96x96 or 96x72, where do you think it came from and were does it belong?
NeedKarma
Sep 8, 2009, 10:44 AM
Sounds like it was a thumbnail.
itsashnow
Sep 8, 2009, 10:54 AM
Thankz for the fast response
itsashnow
Sep 8, 2009, 10:58 AM
Sounds like it was a thumbnail.
If it is a thumbnail where do it belong? Would that be in a thumbs.db?
itsashnow
Sep 8, 2009, 11:02 AM
I have a e01 image there is file called thumbs.db encryptable, am using ftk toolkit how do I recover it data carved won't recover it.
NeedKarma
Sep 8, 2009, 11:07 AM
Try sorting the files by name and check out the extensions. If the extensions are not recognizable image types then I don't know how to help you.
itsashnow
Sep 8, 2009, 11:14 AM
Okay I got the file names, the only problem I have right now is that when I view the free space right the first file there is file0 it is a long file name but it doesn't have an extension, and the second problem I have is, I can see there is a thumbs.db encrytpable but I don't know how to recover it, I don't see a option or anyting I ftk toolkit
crigby
Sep 8, 2009, 11:39 AM
Hi,
Do a Search for FileAlyzer; available for free many places. It will give you a view of the contents in several ways.
Most of my systems default to it with extensions not listed in the Registry. You may need to only change the extension to one of a graphic.
Peace,
Clarke
itsashnow
Sep 8, 2009, 03:36 PM
Thanks will try.
itsashnow
Sep 8, 2009, 05:40 PM
Still can't recover any files, the filealyzer is really good it pick out all the file names, but I just need to recover it now
crigby
Sep 10, 2009, 01:14 PM
Hi,
It is unclear if you have one omnibus file or separate ones. If it is one big one, use a program such as Editpad Lite or Notepad++ to copy the pieces to a new file and the Save As... option to name it correctly. If they are separate files, then no need to break into pieces, just the save. Can also be done with Esxplorer or File Manager by simply clicking name slowly twice and changing it to and extant (extension) that a graphics program understands.
Peace,
Clarke
itsashnow
Sep 11, 2009, 05:03 AM
Thankz