News for hackers. Stuff that matters.
Re:Archive that can be reconstructed with total loss of file... by jaclaz on Sunday April 30, 2017 @02:27PM (#14233070)
Sure, I tested a couple of times Adroit, anyway it is (was) only about some specific file formats (photos, aka jpeg's), and even the Authors' "pitch" was about (only) 20% more photos recovered, I remember not being that much impressed by the results of the actual tests (but maybe the devices on which I tested it at the time also suffered from other forms of corruption): https://web-beta.archive.org/web/20120313073659/http://digit...

https://web-beta.archive.org/web/20120806031446/http://photo...

Some info about Smart Carving (for those interested):

http://www.forensicswiki.org/wiki/File_Carving:SmartCarving

and GuidedCarving:

http://www.forensicswiki.org/wiki/File_Carving:GuidedCarving

I am pretty sure that a similar tool (specific for photos/jpeg's) would be very useful, but extending the same principles to different file formats is - as I see it - extremely hard and in a large number of cases simply impossible (due to the actual structure of the file format itself).

Re:Archive that can be reconstructed with total loss of file... by dr_zoidberg on Monday May 01, 2017 @02:38AM (#14235972)
Depends on the format, for example PNG has checksums per segment which make it extremely easy to find if the segment has been correctly rebuilt. Same goes for ZIP and RAR, and JPEGs can be matched against the Huffman tables for invalid byte sequences.

Also for JPEG there was a (sort of experimental) carver that validated the image against the thumbnail, and then decided if it was correctly reconstructed or not (and maybe it also helped to choose the correct block when there was an error). Still, most of this tools never left the alpha stage, and ended as curiositys presented in a conference and then left to rot.

Re:Archive that can be reconstructed with total loss of file... by jaclaz on Monday May 01, 2017 @04:43AM (#14236306)
Yes :), it is queer how some programs/tools that should exist and of which we do have the basic algorithms were never properly written/developed while we have tens or hundreds of tools similar among them missing these functionalities. Another kind of tool that was never properly developed is interactive jpeg repair, besides the good jpegsnoop: http://www.impulseadventure.com/photo/jpeg-snoop.html (which has only some of these functionalities) there are a handful of tools that are of little or "very narrow" use, but nothing much effective at rebuilding a damaged jpeg.
Re:Archive that can be reconstructed with total loss of file... by dr_zoidberg on Monday May 01, 2017 @12:07PM (#14238736)
I've seen this in the steganography/steganalysis "community": almost every time a script or program is written, its purpose is to rapidly fix the needs by some highly specialized expert who deems that development too simple (that is, to himself) to further develop into a full-fledged tool.