My mom had an old flip phone that she wanted the pictures recovered from. As best as I could tell from booting the phone on, it was dead. No matter, FTK imager to the rescue!
I wrote a small python script that looked for pictures in 3 formats, JPEG/JPG, PNG, and GIF files. It went through the disk image bit by bit (which was itself a bit-by-bit copy of the phone’s memory) looking for the magic numbers indicative of a picture. Two good resources that list file magic numbers are:
While I did create a python script at Github Link, I was having some issues extracting pictures. The issue I was having is that my script for some reason was interpreting multiple 0xFFD9 sequences where I only expected there to be one. I could spend time fixing my script, but there could have been other issues with the script that I wasn’t aware of, and I didn’t want to risk missing some of the information, or possibly corrupting pictures. (As a side note, I could have always done another copy from the phone’s memory, and the python script wasn’t writing to the disk image, so I am more worried here about image fidelity and accuracy, as opposed to a loss of the data)
Given this, I decided to just leave my python script as a learning project and to use a popular open source tool named Autopsy. It was able to recover more types of data than I coded for in my python script, and gave a nice structured output that looked like this:
All said and done, I recovered 85 photos, and was able to give them to my mom!
