This is the code I've been able to figure out. I really don't know how to procced further. Any help would be much appreciated.


int main(int argc, char *argv[])
        fprintf(stderr, "Usage: ./copy ForensicImageName\n");
        return 1;

    char *inptr=argv[1];
    FILE *ip=fopen(inptr, "r");
    fprintf(stderr, "Forensic image cannot be opened for reading");
    return 2;

int *buffer=(int *)malloc(sizeof(ip));
int y=fread(buffer,512,1,ip);
if(buffer[0]==0xff && buffer[1]==0xd8 && buffer[2]==0xff && (buffer[3] & 0xf0)

return 0;
  • Please elaborate as to what is the problem so we can help you. What do you mean by not knowing out to proceed further? Is there a specific problem you have? Commented Apr 2, 2017 at 15:59

1 Answer 1


In Zamlya Chan's walkthrough video, the TODO is listed as follows:

  • open memory card file
  • find beginning of JPEG
  • open a new JPEG
  • write 512 bytes until new JPEG is found
  • detect end of file

The pseudocode for recover is:

open card file
repeat until end of card
    read 512 bytes into a buffer
    start of a new JPEG?
        yes -> .......
        no -> ........
    already found a JPEG?
        no -> ........
        yes -> .......
close any remaining files

The TODO should help you figure out what to do when you reach start of a new JPEG?and/or already found a JPEG?. You should review the pseudocode and TODO and then look back over your own code. Then, you can make the proper changes/additions to your code.

If you still have issues, comment below.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .