Batman Posted October 26, 2015 Share Posted October 26, 2015 So I'm working in Kali and want to reconstruct this QR code image from multiple files. I remember this topic being touched on briefly in a digital forensics class I took a few years ago, but can't remember where to begin. There are 4 files involved, and only one has the top 1/4 of the QR image. The others are the ones stumping me. I think the 3 other files are encrypted, but when I use FTK imager the contents aren't really identifiable to a certain encryption type. It's gibberish. Would anyone be able to suggest a good tool to use in windows or in linux for this kind of thing? Thanks! Quote Link to comment Share on other sites More sharing options...
Batman Posted October 26, 2015 Author Share Posted October 26, 2015 nevermind! I used cat! Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted November 1, 2015 Share Posted November 1, 2015 Glad you got it figured out. FTK Imager (and other tools) will only identify the first image with the jpg header FF D8. The other three it wouldn't be able to identify since it's raw data in the middle of a file. Quote Link to comment Share on other sites More sharing options...
Batman Posted November 1, 2015 Author Share Posted November 1, 2015 I couldn't believe how simple it was. I was fiddling with FTK Imager and also with EnCase. While you are right about the jpg header, you can also see the end of a jpg file because it is denoted with footer info, FF D9. Once I realized that I was thinking of how to combine all 4, and so I just tried cat and that worked! It was just a guessing game with the last 2 remaining files as to which order they came in, but I got it and was able to reconstruct the image. :) Quote Link to comment Share on other sites More sharing options...
Mr-Protocol Posted November 1, 2015 Share Posted November 1, 2015 I haven't use EnCase in a very long time. I'm an FTK user. And you are right, it is a guessing game at the point. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.