I have a snapshot of the memory of a device loaded up in FTK Imager.
I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the memory snapshot, but it is split in several different fragments (about 80 of them).
Each segment is exactly 4096 bytes long (except for the last one, probably).
I can manually look them up by copying the entire 4096 fragment in hex with FTKi, then searching it in the snapshot, and exporting the fragment.
The problem is, this takes a lot of time. Is there any way to do this faster, either using FTK or another software that allows reading and carving from ad1 snapshots?
Furthermore, how would I "fuse" the exported segments in the end, to show that the picture is still complete?