cgsecurity.org

Hello,

Im feeding photorec an exe file with this command line:

photorec_win.exe /debug /log /cmd "file.exe" partition_none,fileopt,search /d "rec"

or

photorec_win.exe /debug /log /cmd "file.exe" fileopt,everything,enable,search /d "rec"

and it only outputs the exe file, no png, i then extracted the png manually and checked with

fidentify_win.exe "00004815.png"
00004815.png: png

so it seems the signature matches, i believe it could be due to the search mode in use, i will keep fiddling around but if anyone notices what could be going on please let me know!

-r1ck

The png inside the exe file isn't aligned to 512 byte boundary.
Try

thank you!