Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to recover some gimp files (*.xcf) from a damaged partition. I've tried testdisk to no avail. I have been able to recover files with scalpel. The process for doing this is by uncommenting the right lines in the scalpel configuration file, /etc/scalpel/scalpel.conf

Here is an excerpt from the file. I have it set to only look for JPEG files below,

# AOL ART files
#  art   y  150000   \x4a\x47\x04\x0e  \xcf\xc7\xcb
#  art   y  150000   \x4a\x47\x03\x0e  \xd0\xcb\x00\x00
#
# GIF and JPG files (very common)
#  gif   y  5000000     \x47\x49\x46\x38\x37\x61   \x00\x3b
#  gif   y  5000000     \x47\x49\x46\x38\x39\x61   \x00\x3b
   jpg   y  200000000   \xff\xd8\xff\xe0\x00\x10   \xff\xd9  

In order to recover gimp files (*.xcf), I need to know what the header and footers are for gimp files. Using ghex2 to view the binary information, I was able to look at jpeg files and confirm that "ff d8 ff e0 00 10" appears near the beginning, and "ff d9" appears near the end of every JPEG file. Trying this approach, I have not been able to locate the header or footer of gimp files. They don't seem to have any consistency from file to file.

I need to know whether gimp files are recoverable by file carving. Thanks.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

TestDisk is awesome but I think it uses a different method from file-carving to un-delete files. They mention something about it scanning the MFT in order to recover files. Have you tried PhotoRec? It's made by the same people and it lists .xcf files in the list of supported files. Photorec appears to use file carving techniques based on their description.

The Specification for the .xcf file type shows that xcf files always start with "gimp xcf"

268     The image structure always starts at offset 0 in the XCF file.
269     
270     byte[9] "gimp xcf " File type magic

enter image description here

I didn't see if it had a footer or something to specify the end of the file. It might just have a bunch of values throughout the file indicating how large the next block of data is. This seems to be indicated in the documentation by:

"The total length of the following payload"

share|improve this answer
    
Thanks! Photorec did the trick! –  Jesse Aug 1 '11 at 14:56
add comment

For futures references here is a list with File Signatures: http://www.garykessler.net/library/file_sigs.html For GIMP for example we add the lines:

# PAT GIMP files

   pat      y      20000000      \x47\x50\x41\x54

Where 20000000 is the maximum possible size from a potencial file, I really didn't know what size to write so i just copy the one from the png files '~'?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.