John Hammond | Thursday, December 31st, 2015
It was found that a Daedalus employee was storing his personal files on a work computer. Unfortunately, he corrupted the filesystem before we could prove it. Can you take a look? Download here.
Hmm, a .img file! With these, your knee-jerk reaction should be to throw some tools at it. Download the file and lets start poking at it.
The first thing I thought to try was binwalk to try and extract stuff out of the file system. Let's do that...
$ $ binwalk -e disk.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
29184 0x7200 JPEG image data, JFIF standard 1.01
121344 0x1DA00 JPEG image data, JFIF standard 1.01
135680 0x21200 JPEG image data, JFIF standard 1.01
313856 0x4CA00 JPEG image data, JFIF standard 1.01
350720 0x55A00 JPEG image data, JFIF standard 1.02
Oooh! Looks like it found some JPG data. But when I run ls, I don't see these files actually extracted... hmm.
Let's try another tool commonly used with disk image files, foremost.
Looks like we got all the JPG files out! I run eog just to display the images.
Submit: i_can_has_cheezburger