Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to recover some gimp files (*.xcf) from a damaged partition. I've tried testdisk to no avail. I have been able to recover files with scalpel. The process for doing this is by uncommenting the right lines in the scalpel configuration file, /etc/scalpel/scalpel.conf

Here is an excerpt from the file. I have it set to only look for JPEG files below,

# AOL ART files
#  art   y  150000   \x4a\x47\x04\x0e  \xcf\xc7\xcb
#  art   y  150000   \x4a\x47\x03\x0e  \xd0\xcb\x00\x00
# GIF and JPG files (very common)
#  gif   y  5000000     \x47\x49\x46\x38\x37\x61   \x00\x3b
#  gif   y  5000000     \x47\x49\x46\x38\x39\x61   \x00\x3b
   jpg   y  200000000   \xff\xd8\xff\xe0\x00\x10   \xff\xd9  

In order to recover gimp files (*.xcf), I need to know what the header and footers are for gimp files. Using ghex2 to view the binary information, I was able to look at jpeg files and confirm that "ff d8 ff e0 00 10" appears near the beginning, and "ff d9" appears near the end of every JPEG file. Trying this approach, I have not been able to locate the header or footer of gimp files. They don't seem to have any consistency from file to file.

I need to know whether gimp files are recoverable by file carving. Thanks.

share|improve this question
up vote 1 down vote accepted

TestDisk is awesome but I think it uses a different method from file-carving to un-delete files. They mention something about it scanning the MFT in order to recover files. Have you tried PhotoRec? It's made by the same people and it lists .xcf files in the list of supported files. Photorec appears to use file carving techniques based on their description.

The Specification for the .xcf file type shows that xcf files always start with "gimp xcf"

268     The image structure always starts at offset 0 in the XCF file.
270     byte[9] "gimp xcf " File type magic

enter image description here

I didn't see if it had a footer or something to specify the end of the file. It might just have a bunch of values throughout the file indicating how large the next block of data is. This seems to be indicated in the documentation by:

"The total length of the following payload"

share|improve this answer
Thanks! Photorec did the trick! – Gruzzles Aug 1 '11 at 14:56

For futures references here is a list with File Signatures: For GIMP for example we add the lines:

# PAT GIMP files

   pat      y      20000000      \x47\x50\x41\x54

Where 20000000 is the maximum possible size from a potencial file, I really didn't know what size to write so i just copy the one from the png files '~'?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.