A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Subscribestar or Patreon

Search Irongeek.com:

Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:




Section: User Commands (1)
Updated: January 2010
Index of this MAN page

Back To MAN Pages From BackTrack 5 R1 Master List  


recoverjpeg - recover jpeg pictures from a filesystem image  


recoverjpeg [options] device  


Recoverjpeg tries to identify jpeg pictures from a filesystem image. To achieve this goal, it scans the filesystem image and looks for a jpeg structure at blocks starting at 512 bytes boundaries.

Salvaged jpeg pictures are stored by default under the name imageXXXXX.jpg where XXXXX is a five digit number starting at zero. If there are more than 100,000 recovered pictures, recoverjpeg will start using six figures numbers and more as soon as needed, but the 100,000 first ones will use a five figures number. Options -f and -i can override this behaviour.



Display an help message.
-b blocksize
Set the size of blocks in bytes. On most file systems, setting it to 512 (the default) will work fine as any large file will be stored on 512 bytes boundaries. Setting it to 1 maximize the chances of finding very small files if the filesystems aggregates them (UFS for example) at the expense of a much longer running time.
-f formatstring
Set the filename format string (printf-style, default: "image%05d.jpg"). It is used with the image index as an integer argument.
-i integerindex
Set the initial index value for image numbering (default: 0).
-m maxsize
Maximum size of extract jpeg files. If a file would be larger than that, it is discarded. The default is 6 MiB.
Be quiet and do not display anything.
-r readsize
Set the readsize in bytes. By default, this is 128 MiB. Using a large readsize reduces the number of system calls but consumes more memory. The readsize will automatically be adjusted to be a multiple of the system page size. It must be greater than the maxsize parameter.
Be verbose and describes the process of jpeg identification. By default, if this flag is not used, recoverjpeg will print a progress bar showing how much it has analyzed already and how many jpeg pictures have been recovered.

All the sizes may be suffixed by a k, m or g letter to indicate KiB, MiB or GiB. For example, 6m correspond to 6 MiB (6291456 bytes).



Recover as many pictures as possible from the memory card located in /dev/sdc:

  recoverjpeg /dev/sdc

Recover as many pictures as possible from a crashed ReiserFS file system (which does not necessarily store pictures at block boundaries) in /dev/hdb1:

  recoverjpeg -b 1 /dev/hdb1

Do the same thing in a memory constrained environment where no more than 16MB of RAM can be used for the operation:

  recoverjpeg -b 1 -r 16m /dev/hdb1



Recoverjpeg has been written by Samuel Tardieu <sam@rfc1149.net>.

If recoverjpeg saves your day and you liked it, you are welcome to send me the best rescued ones by email (please send only 800x600 versions of the pictures) and authorize me to put them online (indicate which contact information you want me to use for credits).



Copyright (c) 2004-2010 Samuel Tardieu <sam@rfc1149.net> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.



recovermov(1), sort-pictures(1)



Recoverjpeg does not include a complete jpeg parser. You may need to use sort-pictures afterwards to identify bogus pictures. Some pictures may be corrupted but have a correct structure; in this case, the image may be garbled. There is no automated way to detect those pictures with a 100% success rate.




This document was created by man2html, using the manual pages.
Time: 07:34:21 GMT, September 13, 2011

Printable version of this article

15 most recent posts on Irongeek.com:

If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2020, IronGeek
Louisville / Kentuckiana Information Security Enthusiast