Gimp file recovery

Question

I need to recover some gimp files (*.xcf) from a damaged partition. I've tried testdisk to no avail. I have been able to recover files with scalpel. The process for doing this is by uncommenting the right lines in the scalpel configuration file, /etc/scalpel/scalpel.conf

Here is an excerpt from the file. I have it set to only look for JPEG files below,

# AOL ART files
#  art   y  150000   \x4a\x47\x04\x0e  \xcf\xc7\xcb
#  art   y  150000   \x4a\x47\x03\x0e  \xd0\xcb\x00\x00
#
# GIF and JPG files (very common)
#  gif   y  5000000     \x47\x49\x46\x38\x37\x61   \x00\x3b
#  gif   y  5000000     \x47\x49\x46\x38\x39\x61   \x00\x3b
   jpg   y  200000000   \xff\xd8\xff\xe0\x00\x10   \xff\xd9  

In order to recover gimp files (*.xcf), I need to know what the header and footers are for gimp files. Using ghex2 to view the binary information, I was able to look at jpeg files and confirm that "ff d8 ff e0 00 10" appears near the beginning, and "ff d9" appears near the end of every JPEG file. Trying this approach, I have not been able to locate the header or footer of gimp files. They don't seem to have any consistency from file to file.

I need to know whether gimp files are recoverable by file carving. Thanks.

Answer 1

TestDisk is awesome but I think it uses a different method from file-carving to un-delete files. They mention something about it scanning the MFT in order to recover files. Have you tried PhotoRec? It's made by the same people and it lists .xcf files in the list of supported files. Photorec appears to use file carving techniques based on their description.

The Specification for the .xcf file type shows that xcf files always start with "gimp xcf"

268     The image structure always starts at offset 0 in the XCF file.
269     
270     byte[9] "gimp xcf " File type magic

I didn't see if it had a footer or something to specify the end of the file. It might just have a bunch of values throughout the file indicating how large the next block of data is. This seems to be indicated in the documentation by:

"The total length of the following payload"