I am working on the recover problem and I request some help. Well as the problem requires that search through raw data to get and save images separately, I am working on the problem step by step. At this point I have been able to code the program to accept one command line argument. I am currently having problems with the fread function in the loop. It is my understanding that the first argument for fread is a pointer to a store where I can place the elements from the second, third and forth arguments. My intention afterwards is that I can search the elements in the store (&buffer[0]), for the bytes of interest. However, after "freading", I find that the first 512 bytes from the card are different from those stored in the buffer[0]. So I cannot proceed to start searching for the first 4 bytes of interest. It is possible that I am approaching this the wrong way and I will appreciate any advice on how to finish the problem set from where I am now.

/** * * - recover - * * a program that accepts a forensic image from * which to recover jpegs * */

 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>

 #define FILE_NAME "temp.txt"

  int main(int argc, char *argv[])
     if (argc != 2)
         fprintf(stderr, "Only one command line argument\n");
         return 1;

    //Initialising pointer to the card.raw argument
     char *image = argv[1];

     FILE *card = fopen(image, "r");

    //Creating a BYTE struct
     typedef uint8_t BYTE;

    //Initialising a variable for a single byte
     BYTE *single_byte = NULL;

    //Calculating the size of the card in bytes
     fseek(card, sizeof(single_byte), SEEK_END);
     long size = 0;
     size = ftell(card);
     printf("I am size: %li | Size of singlebyte: %lu\n", size, sizeof(*single_byte));

    //Moving the cursor to the starting position
    fseek(card, -1*size, SEEK_CUR);
    long offset = 0;
    offset = ftell(card);
    printf("Current offset: %lu | Current size: %li\n", offset, size);

    int buffer[513];

    // looping through the card to store the elements in a buffer array
    for (int i = 0; i < 512; i++)
        fread(&buffer[0], sizeof(*single_byte), 512, card);
        printf("%i: %x\n", i, buffer[i]);



sizeof(single_byte) is likely 8 (64 bit system). I don't understand its usage at that point, or the need for that variable at all. You don't even need the total file size.

Use a BYTE[512], not int[513] for the buffer.

And your loop is reading 512 blocks of 512 bytes each. Is that intended?

  • Sorry I have taken long to get back to you on this. Was doing tests at the university and could not make time to get into learning code. Thank you for your feedback. Use of sizeof(single_byte) was to get the total size of the file given to us so that I can iterate through it 512 bytes at a time; temporarily storing it and searching the 1st 4 bytes to find out if its the start of a jpeg. As for the 512 block of bytes, it was intentional meant as a test to store the first 512 bytes from the file and compare them them to the &buffer[i]. After I would have to replace the 512 in the loop with size – alanana Oct 3 '18 at 5:39
  • sizeof(single_byte) makes no sense to me in fseek, do you try to set the file pointer to 8 bytes behind file size? And you had your loop do 512 reads of 512 bytes each, reading the first 262144 bytes. That's not the same as reading the first 512 bytes and comparing them to something else. – Blauelf Oct 4 '18 at 7:24

Okay, for clarification. I was trying to fread the first 512 bytes into a buffer and to check to see if the bytes were indeed written in byte by "fprinting" the elements of the buffer. The solution lay in "freading" outside the loop and "fprinting" inside the loop. Well as I still have considerable work to do. I am happy I have gone over this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .