How can I get the signature?

Question

I've been stuck on recover.c for a while now, and looking into the GDB, I've seen that when I fread card.raw into a variable to be able to pass it on, and found that there wasn't a single time in the beginning where the first 4 bytes were 0xff, 0xd8, 0xff, 0xe0, or 0xff, 0xd8, 0xff, 0xe1. What can I do to find out the real signature, or what I did wrong?

Here's the code where the whole thing is started.

FILE* file = fopen("card.raw", "r");
BYTE printJPG[511];
int counter = 0;
int blockCounter = 0;
char fileName[10];
FILE* writing;
sprintf(fileName, "00%i.jpg", counter);
writing = fopen(fileName, "w");
while(!feof(file)) {
fseek(file, ((blockCounter * 512) + 1), SEEK_SET);
fread(&printJPG[0], 1, 1, file);
if(printJPG[0] == 0xff)
{
    fread(&printJPG[1], 1, 1, file);
    if(printJPG[1] == 0xd8)
    {
        fread(&printJPG[2], 1, 1, file);
            if(printJPG[2] == 0xff) {
                fread(&printJPG[3], 1, 1, file);
                if(printJPG[3] == 0xe0) {
                //more stuff happens here
                } else if(printJPG[3] == 0xe1) {
                //again
                }
         //not much code after this, and nothing pertaining to my question.

Answer 1

It looks like the code is not aligning with the 512 byte boundaries, and it's looking for the signature one byte off. Look at this line:

fseek(file, ((blockCounter * 512) + 1), SEEK_SET);

Why is 1 being added? Think about it. If you want to check the beginning of the file, blockCounter would be 0, so this would look at byte 1, but the signature would start at byte 0. Same logic applies to any value for blockCounter.

This is probably why you aren't finding any signatures and there may be other issues, (like why your buffer is 511 bytes and not 512) but those would be different questions.

If this answers your question, please click on the check mark to accept. Let's keep up on forum maintenance. ;-)