0

I was able to recover the jpeg's (49 of them)...but running check50 shows ONE RED (wrong)..I've tried very hard to figure what went wrong...please help me find my mistake or please give an hint to figure it out...thank you

here's my code to read and write in the file

   int count=0;
        FILE *img=NULL;
        while(!feof(file)){
                 //declare array for box
             unsigned char buffer[512];
             //read box by box
             fread(buffer,sizeof(buffer),1,file);

            //if its the start of jpg
            if((buffer[0]==0xff && buffer[1]==0xd8 && buffer[2]==0xff) && (buffer[3]==0xe0||buffer[3]==0xe1|| buffer[3]==0xe2||buffer[3]== 0xe3|| buffer[3]==0xe4|| buffer[3]==0xe5||buffer[3]==0xe6|| buffer[3]==0xe7|| buffer[3]==0xe8|| buffer[3]==0xe9||buffer[3]== 0xea|| buffer[3]==0xeb||buffer[3]== 0xec||buffer[3]== 0xed||buffer[3]==0xee|| buffer[3]==0xef) ){
                //create new jpg
                char filename[8];
                sprintf(filename,"%03i.jpg",count);
                //open created jpg and write
                 img=fopen(filename,"w");
                 fwrite(buffer,sizeof(buffer),1,img);
                 count++;
               //if not the start of jpg and the jpg is already open  
            }else if(img!=NULL){
                fwrite(buffer,sizeof(buffer),1,img);
            }
        }
        //close img  
        fclose(img);

and here is the check50 result

:) recover.c exists.
:) recover.c compiles.
:) handles lack of forensic image
:) recovers 000.jpg correctly
:) recovers middle images correctly
:( recovers 015.jpg correctly
    recovered image does not match
1

feof returns non-zero only after a failed fread (or other read operation). This means it would have to be placed below the read operation.

The mistake is not visible in the images, as this simply means you got an extra 512 bytes (last block again) at the end of the last image.

You can instead move your fread into the condition, like

     unsigned char buffer[512];
     while(fread(buffer,sizeof(buffer),1,file) == 1) {

testing whether fread was able to read a whole block of 512 bytes.

4
  • thank you this seems to work!! does this mean in my case where i used !feof it was skipping some bytes...though its not visible at all.....@Blauelf could you please explain it a bit more to me.. – shaistha Sep 26 '17 at 15:42
  • You were not skipping. You were entering the loop one last time after reaching the end of the file. fread would fail, you would write the buffer with the last block a second time, and only now feof would return non-zero. – Blauelf Sep 26 '17 at 16:10
  • ok now i get it, thank you – shaistha Sep 26 '17 at 16:12
  • @Blauelf, sorry to disturb you on this topic a few years later but wouldn't it make more sense that the buffer is int instead of char? I was using uint8_t int buffer[] as the buffer to hold bytes or data in it and was having the same last-extra-512-bytes problem. Saw your solution and had to change it to unsigned char to apply your fix because I couldn't go around it myself. But my question is why is char an appropriate data type to hold in bytes of data? Shouldn't it be in int because those bytes are hexadecimal form representing probably RGB values or something right? How'd char handle them? – Serial.A12 Jun 29 '20 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .