cgsecurity.org

Hello,

while using this command line in a binary file, I have lot of corrupted tif files being extracted while they are in fact jpg

photorec_win.exe /log /debug /cmd "file.exe" partition_none,blocksize,1,search /d "recovered"

I took one of the corrupted tif files and added the jpg header @ the beggining of the file :
FFD8FFE000104A46494600010101006000600000FFE1005A457869660000

and it worked, however i cant explain why this is happening.

from the logs it seems photorec thinks these jpgs are corrupted:

Elapsed time 0h00m08s
Pass 1 +65 files
tif: 46/49 recovered
png: 9/9 recovered
icc: 5/5 recovered
txt: 4/4 recovered
res: 1/1 recovered
exe: 0/1 recovered
jpg: 0/52 recovered
Total: 65 files found

0-598: exe
700-700: jpg
866-866: jpg
1025-1025: jpg
1139-1139: jpg
1146-1261: (null)
1261-1261: jpg
1391-1391: jpg
1531-1531: jpg
1537-1644: (null)
1644-1644: jpg
1776-1776: jpg
1921-1921: jpg
2061-2062: jpg
2250-2250: jpg
2409-2409: jpg
2557-2557: jpg
3957-4003: jpg
4268-4268: jpg
4460-4460: jpg
4576-4576: jpg
4683-4683: jpg
4775-4775: jpg
4903-4903: jpg
5013-5016: jpg
5016-5062: (null)
5063-5068: (null)
5069-5083: (null)
5083-5083: jpg
5208-5208: jpg
5320-5320: jpg
5476-5476: jpg
5608-5608: jpg
5739-5739: jpg
5869-5869: jpg
6001-6001: jpg
6109-6109: jpg
6212-6212: jpg
6315-6315: jpg
6315-6414: tif
6414-6414: jpg
6414-6510: tif
6510-6510: jpg
6510-6605: tif
6605-6605: jpg
6612-6635: (null)
6635-6699: (null)
6699-6699: jpg
6812-6812: jpg
6924-6924: jpg
7000-7000: jpg
7109-7109: jpg
7212-7212: jpg
7312-7312: jpg
7411-7411: jpg
7513-7513: jpg
7610-7692: jpg
7692-7692: jpg
7698-7799: (null)
7799-7799: jpg
7806-7898: (null)
7898-7898: jpg
8046-8046: jpg
8157-8157: jpg
8262-8262: jpg
1644 sectors contains unknown data, 56 invalid files found and rejected.
PhotoRec exited normally.

Can you send me an unmodified jpg ? I will check if I can fix this problem.
In the meantime, no need to create a custom signature, you probably only need to disable tiff in FileOpts.

Hello,

2 files here: http://rghost.net/private/72tpZTKZR/844 ... efab22e03e

let me know if you need more.

thank you!

I need an unmodified original jpg, not a recovered tif.

what do you mean by original jpg ? this tif file is a jpg in fact, just add the header bytes and it will be possible to view it

Yes, one original unmodified jpg.
Edit: nerver mind. I forgot the blocksize forced to 1.

I have uploaded a new 7.1-WIP. Can you try it ?

it works, thank you!