How to use recoverjpeg in Kali linux
Intro - Recoverjpeg tries to identify jpeg pictures from a filesystem image. To achieve this goal, it scans the filesystem image and looks for a jpeg structure at blocks starting at 512 bytes boundaries.
salvaged jpeg pictures are stored by default under the name imageXXXXX.jpeg where XXXXX is a five digit number starting at zero. If there are more than 100,000 recovered pictures, recoverjpeg will start using six figures numbers and more as soon as needed, but the 100,000 first ones will use a five figures number.
1. How to open recoverjpeg
A. GUI Method
Application → Kali linux→ Forensics → Forensic Carving Tools → recoverjpeg
(click image for large view)
B. open Terminal type recoverjpegand hit enter
2. Right Click on Desktop and click on ‘Create New Folder’
3. Rename your created Folder ‘Picture’. We created this folder because we will save our recovered picture on this folder.
4. Change the directory using ‘ls’ and ‘cd’ command. We need to go to the directory where we want to save our recovered jpeg file. Here I am saving my jpeg in picture folder. Follow image
5. Before using recoverjpeg command we need to recognize our target partition path so use fdisk –lcommand. ( Here I am using my Pendrive)
6. Now run command recoverjpeg /dev/sdb1 your recovering is in process. It will take some time to complete.
7. We have successfully recovered 2446 pictures from our target partition.
8. Here you can see our recovered jpeg in picture folder.
(click image for large view)
Like it ? Share it.
