1

I have a snapshot of the memory of a device loaded up in FTK Imager.

I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the memory snapshot, but it is split in several different fragments (about 80 of them).

Each segment is exactly 4096 bytes long (except for the last one, probably).

I can manually look them up by copying the entire 4096 fragment in hex with FTKi, then searching it in the snapshot, and exporting the fragment.

The problem is, this takes a lot of time. Is there any way to do this faster, either using FTK or another software that allows reading and carving from ad1 snapshots?

Furthermore, how would I "fuse" the exported segments in the end, to show that the picture is still complete?

1

I don't know that there is any way to know where the fragments are stored within memory (or the memory snapshot) like there might be if it were in a file system. So searching on each may be the only way there. As for automating that process, I don't know of anything available.

You can use hex editing software to do the searching, copying out blocks of data into separate files, and then putting them together into a single file. It will be a lot of manual work, but not overwhelming for just 80 blocks. We've written software that will do similar in an automated fashion (and actually that middle step is not needed when offsets are used), but it isn't publicly available unfortunately. However, I mention that because you may want to consider a custom software solution if you do this many times. But if you just are doing it once, manually would be just fine.

I put a couple hex editor links below. I believe FTK Imager is a Windows software so here are some Windows choices-

2
  • 1
    While waiting for answers on the question, I've started working on a short C# program that would do that for me. Considering the fact that I most likely will never have to do it again, I don't need to make anything fancy. I'll look at what your links have to offer
    – Kaito Kid
    Jul 7 '17 at 16:08
  • @KaitoKid Great, good luck! That is how most of our custom recovery software starts. We need it once for one data recovery case. Then if we find we need it additional times, we put more work into it. Jul 10 '17 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.