Recover (CS50)

Recover.c is a digital forensics program in C that recovers JPEG images from raw memory files. It scans data blocks for JPEG headers, efficiently reconstructing images. The program utilizes conditional checks, precise data parsing, and file operations, showcasing its ability to handle complex data recovery and file reconstruction tasks.

• To implement a program capable of identifying and reconstructing JPEG files from a forensic image.
• To manage file operations and memory efficiently without leakage.
• To navigate complex binary data structures, enhancing problem-solving skills.
• To produce a practical tool that could be utilized in digital forensics investigations.

Key Features

1. File Handling:
   • Handles opening, validating, and reading the forensic image file.
2. Data Block Processing:
   • Reads the forensic image in 512-byte blocks, using a buffer for data storage and processing.

   uint8_t buffer[BLOCK_SIZE];
   while (fread(buffer, BLOCK_SIZE, 1, file) == 1)
   {
       // ... (further processing)
   }
   

3. JPEG Identification:
   • Detects the start of JPEG files by identifying specific byte patterns.

   if (buffer[0] == 0xff && buffer[1] == 0xd8 && buffer[2] == 0xff && (buffer[3] & 0xf0) == 0xe0)
   {
       // ... (JPEG handling code)
   }
   

4. Dynamic File Creation and Management:
   • Dynamically creates and manages new JPEG files.

   sprintf(jpg_nm, "%03d.jpg", jpg_n);
   out = fopen(jpg_nm, "w");
   if (out == NULL)
   {
       fclose(file);
       printf("Could not create file\n");
       return 2;
   }
   

5. Writing Recovered Data:
   • Writes the buffer’s contents to the current JPEG file, effectively recovering the image data.
6. Memory and File Management:
   • Ensures all file streams are properly closed, preventing memory leaks and file corruption.