Notice incidentally that pset5jpg is empty its up to

Info iconThis preview shows page 1. Sign up to view the full content.

View Full Document Right Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: store photographs contiguously on CF cards, whereby each photo is stored immediately after the previously taken photo. Accordingly, the start of a JPEG usually demarks the end of another. However, digital cameras generally initialize CF cards with a FAT file system whose “block size” is 512 bytes (B). The implication is that these cameras only write to those cards in units of 512 B. A photo that’s 1 MB (i.e., 1,048,576 B) thus takes up 1048576 ÷ 512 = 2048 “blocks” on a CF card. But so does a photo that’s, say, one byte smaller 19 We’ve not made solutions available for this problem set’s other programs, lest they spoil the forensic fun. Computer Science Investigation 21 It’s possible only part of this sentence is true. 22 Actual credit for photos goes to ACM, Dan Armendariz, Eliza Grinnell, Harvard Crimson, Harvard Gazette, NVIDIA, SEAS, Titus Zhang, et al. 23 This one’s pretty much true. 24 To be sure, you might encounter these patterns on some disk purely by chance, so data recovery isn’t an exact science. 20 12 < 16 This is CS50. Harvard College Fall 2010 (i.e., 1,048,575 B)! The wasted space on disk is called “slack space.” Forensic investigators often look at slack space for remnants of suspicious data. The implication of all these details is that you, the investigator, can probably write a program that iterates over a copy of my CF card, looking for JPEGs’ signatures. Each time you find a signature, you can open a new file for writing and start filling that file with bytes from my CF card, closing that file only once you encounter another signature. Moreover, rather than read my CF card’s bytes one at a time, you can read 512 of them at a time into a buffer for efficiency’s sake. Thanks to FAT, you can trust that JPEGs’ signatures will be “block ­aligned.” That is, you need only look for those signatures in a block’s first four bytes. Realize, of course, that JPEGs can span contiguous blocks. Otherwise, no JPEG could be larger than 512 B. But the last byte of a JPEG might not fall at the very end of a block. Recall the possibility of slack space. But not to worry. Because this CF card was brand ­new when I started snapping photos, odds are it’d been “zeroed” (i.e., filled with 0s) by the manufacturer, in which case any slack space will be filled with 0s. It’s okay if those trailing 0s end up in the JPEGs you recove...
View Full Document

Ask a homework question - tutors are online