Recover damage pictures to see the crime scene

时间:2024-11-11 16:04:32

Few people know that when you take photos there is also a thumbnail embeded inside the file, even some forensic guys may have no idea about this important clue. That means if you see a damaged photo, you could try to extract the thumbnail inside the photo, thus you could see it clearly. Let me show you how to do it manually with Winhex.

1. A damaged photo, some part of it is missing, so we could not see the face of our suspect clearly...

Recover damage pictures to see the crime scene

2.Open it with Winhex, and search hex value "FFD8FF" which means the file header of JPGs. There are two hits, and the second one is the header of thumbnamil we're looking for.

Recover damage pictures to see the crime scene

3. Go to the second hit and mark it as the begining of block.

Recover damage pictures to see the crime scene

4.Search hex value "FFD9" which means the footer of JPGs and go to the footer of thumbnail we're looking for. Also mark it as the end of block.

Recover damage pictures to see the crime scene

5. Now we could copy this block into a new file.

Recover damage pictures to see the crime scene

6. That's it. Now you could see the face of our suspect, including the weapon on his/her hans and viechle...

Recover damage pictures to see the crime scene

7. Of course some tools could do this for you, still you have to know why and how and take it into practice.