recover.c

/**
 * recover.c
 *
 * Jody W Moore
 *
 * Computer Science 50
 * Hacker4
 *
 * Recovers JPEGs from a forensic image.
 */
#include <stdio.h>
#include <stdlib.h>

#define CHUNK 512

int main(int argc, char* argv[])
{

    typedef unsigned char BYTE;

    // remember filenames
    char* infile = "card.raw";

    // open input file
    FILE* inptr = fopen("card.raw" ,"r");
    if (inptr == NULL)
    {
        printf("Could not open %s.\n", infile);
        return 2;
    }

    BYTE buffer[CHUNK];
    int jpeg_num = 0;
    char img_ptr[20];
    FILE* outptr = fopen(img_ptr,"w");


    // while our attempt to read a block succeeds
    while(fread(&buffer, sizeof(buffer), 1, inptr) != 0)
    {
        // if this block is the start of new JPEG
        if ( (buffer[0] == 0xff) && (buffer[1] == 0xd8)
           && (buffer[2] == 0xff ) && (buffer[3] == 0xe0) | (buffer[3] == 0xe1) )
        {

            if (outptr != NULL)
            {
                // if there is a file open, close it
                fclose(outptr);

                // open a new file
                sprintf(img_ptr,"%03d.jpg",jpeg_num);
                outptr = fopen(img_ptr,"w");
                jpeg_num++;

                // write this first block into it
                fwrite(&buffer,sizeof(buffer),1,outptr);
            }
        }
        // else
        else
        {
            // if there is a file open, write this block into it
            if (outptr != NULL)
            {
                fwrite(&buffer,sizeof(buffer),1,outptr);
            }
        }

    }
    // Close any remaining files
    fclose(outptr);
    return 0;
}