0

I've tried everything to get that last file, I even ran some printf statement test and the 4 indexes that show the start of a jpg are recognized 50 times in total but i'm still only able to produce 49 of those 50 jpgs. I'm truly stuck and would appreciate any help. Thanks.

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

//typedef uint8_t BYTE;
#define BLOCK 512
int JPEG = 0;
int foundjpg = 0;

int main(int argc, char *argv[])
{

char jpegname [10];
if (argc != 2)
{
    printf("Usage: ./recover card.raw\n");
    //RETURN 1 FOR: "HANDLES LACK OF FORENSIC IMAGE"
    return 1;
}

//OPEN card.raw FILE here
FILE *file = fopen(argv[1], "r");
if (file == NULL)
{
    printf("File was not created.\n");
    return 1;
}

//BUFFER TO READ CARD.RAW INTO
unsigned char card_buffer [BLOCK];

FILE* img = malloc(sizeof(BLOCK));

while (1)    //  WRONG BC FEOF SHOULD BE USED AFTER THE READING, NOT DURING. (!feof(file)  && !ferror(file))
{
    fread(card_buffer, BLOCK, 1, file);
    if (ferror(file) != 0)
    {
        printf("fread error was detected on first read");
        return 0;
    }

    else if (feof(file) != 0)
    {
        fwrite(card_buffer, BLOCK, 1, img);
        break;
    }

   else if (card_buffer[0] == 0xff && card_buffer[1] == 0xd8 && card_buffer[2] == 0xff && ((card_buffer[3] & 0xf0) == 0xe0))
    {
        if (foundjpg == 1)
        {
            fclose(img);
            img = fopen(jpegname, "w");

            sprintf(jpegname, "%03i.jpg", JPEG);
            JPEG++;
            if (img == NULL)
            {
                printf("img FILE could not be created\n");
            }
            else
            {
                fwrite(card_buffer, BLOCK, 1, img);
            }
        }

        else if (foundjpg == 0)
        {
            foundjpg = 1;

            sprintf(jpegname, "%03i.jpg", JPEG);

            img = fopen(jpegname, "w");

            JPEG++;

            if (img == NULL)
            {
                printf("img FILE could not be created\n");
            }

            else
            {
                fwrite(card_buffer, BLOCK, 1, img);
            }
        }
    }
    else if (foundjpg == 1 )
    {
        fwrite(card_buffer, BLOCK, 1, img);
    }

}

fclose(file);
fclose(img);
return 0;
}

2
  • Haven't looked at the code, but is it possible that you're not getting the FIRST file???? – Cliff B May 20 '20 at 23:53
  • Yes, I think it could be. One of the check50s is recovering the 000 jpg, and even though my code produces a 000 jpg, it still isn't passing that check50. – Maty May 21 '20 at 1:34

You must log in to answer this question.

Browse other questions tagged .