How to look up a file that has been split into segments in a memory snapshot

Question

I have a snapshot of the memory of a device loaded up in FTK Imager.

I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the memory snapshot, but it is split in several different fragments (about 80 of them).

Each segment is exactly 4096 bytes long (except for the last one, probably).

I can manually look them up by copying the entire 4096 fragment in hex with FTKi, then searching it in the snapshot, and exporting the fragment.

The problem is, this takes a lot of time. Is there any way to do this faster, either using FTK or another software that allows reading and carving from ad1 snapshots?

Furthermore, how would I "fuse" the exported segments in the end, to show that the picture is still complete?

Answer 1

I don't know that there is any way to know where the fragments are stored within memory (or the memory snapshot) like there might be if it were in a file system. So searching on each may be the only way there. As for automating that process, I don't know of anything available.

You can use hex editing software to do the searching, copying out blocks of data into separate files, and then putting them together into a single file. It will be a lot of manual work, but not overwhelming for just 80 blocks. We've written software that will do similar in an automated fashion (and actually that middle step is not needed when offsets are used), but it isn't publicly available unfortunately. However, I mention that because you may want to consider a custom software solution if you do this many times. But if you just are doing it once, manually would be just fine.

I put a couple hex editor links below. I believe FTK Imager is a Windows software so here are some Windows choices-

• Hex Workshop http://www.hexworkshop.com/ (this is mentioned in FTK Imager user guide)
• WinHex https://www.x-ways.net/winhex/