I need to recover some gimp files (*.xcf) from a damaged partition. I've tried testdisk to no avail. I have been able to recover files with scalpel. The process for doing this is by uncommenting the right lines in the scalpel configuration file, /etc/scalpel/scalpel.conf
Here is an excerpt from the file. I have it set to only look for JPEG files below,
# AOL ART files # art y 150000 \x4a\x47\x04\x0e \xcf\xc7\xcb # art y 150000 \x4a\x47\x03\x0e \xd0\xcb\x00\x00 # # GIF and JPG files (very common) # gif y 5000000 \x47\x49\x46\x38\x37\x61 \x00\x3b # gif y 5000000 \x47\x49\x46\x38\x39\x61 \x00\x3b jpg y 200000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9
In order to recover gimp files (*.xcf), I need to know what the header and footers are for gimp files. Using ghex2 to view the binary information, I was able to look at jpeg files and confirm that "ff d8 ff e0 00 10" appears near the beginning, and "ff d9" appears near the end of every JPEG file. Trying this approach, I have not been able to locate the header or footer of gimp files. They don't seem to have any consistency from file to file.
I need to know whether gimp files are recoverable by file carving. Thanks.