131 lines
20 KiB
Plaintext
131 lines
20 KiB
Plaintext
|
Script started on 2023-04-03 15:13:44+02:00 [COMMAND="bash" TERM="xterm-256color" TTY="/dev/pts/0" COLUMNS="117" LINES="62"]
|
|||
|
|
[?2004h2023-04-03 15:13:44 $ ls -la
|
|||
|
|
[?2004l
total 9512
|
|||
|
|
drwxr-xr-x 2 mark mark 4096 Apr 3 15:11 [0m[01;34m.[0m
|
|||
|
|
drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 [01;34m..[0m
|
|||
|
|
-rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 [01;31mU2.zip[0m
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:13:48 $ file U2.zip
|
|||
|
|
[?2004l
U2.zip: Zip archive data, at least v4.5 to extract, compression method=deflate
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:13:55 $ md5sum U2.zip
|
|||
|
|
[?2004l
31e8feb8e5a501e5302a7ac983336a24 U2.zip
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:14:02 $ shasum U2.zip
|
|||
|
|
[?2004l
409499f04d7bb853cc12991f209bad2d58478cf8 U2.zip
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:14:08 $ unzip U2.zip
|
|||
|
|
[?2004l
Archive: U2.zip
|
|||
|
|
inflating: U2.img
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:15:05 $ ls -la
|
|||
|
|
[?2004l
total 8201516
|
|||
|
|
drwxr-xr-x 2 mark mark 4096 Apr 3 15:14 [0m[01;34m.[0m
|
|||
|
|
drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 [01;34m..[0m
|
|||
|
|
-rw-rw-r-- 1 mark mark 8388608000 Apr 4 2022 U2.img
|
|||
|
|
-rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 [01;31mU2.zip[0m
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:15:24 $ file U2.img
|
|||
|
|
[?2004l
U2.img: DOS/MBR boot sector, code offset 0x58+2, OEM-ID "mkfs.fat", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, sectors 16384000 (volumes > 32 MB), FAT (32 bit), sectors/FAT 15976, serial number 0x61d3b3ac, unlabeled
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:15:30 $ fdisk -l U2.img
|
|||
|
|
[?2004l
[1mDisk U2.img: 7.81 GiB, 8388608000 bytes, 16384000 sectors
|
|||
|
|
[0mUnits: sectors of 1 * 512 = 512 bytes
|
|||
|
|
Sector size (logical/physical): 512 bytes / 512 bytes
|
|||
|
|
I/O size (minimum/optimal): 512 bytes / 512 bytes
|
|||
|
|
Disklabel type: dos
|
|||
|
|
Disk identifier: 0x00000000
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:15:39 $ mkdir mnt
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:15:43 $ sudo mount u2.[K[K[KU2.img mnt[1@-[1@o[1@ [1@r[1@o[1@
|
|||
|
|
[?2004l
[sudo] password for mark:
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:16:05 $ cd mnt
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:16:10 $ ls -la
|
|||
|
|
[?2004l
total 1572
|
|||
|
|
drwxr-xr-x 2 root root 4096 Jan 1 1970 [0m[01;34m.[0m
|
|||
|
|
drwxr-xr-x 3 mark mark 4096 Apr 3 15:15 [01;34m..[0m
|
|||
|
|
-rwxr-xr-x 1 root root 1580424 Apr 4 2022 [01;32mRecoverMe01[0m
|
|||
|
|
-rwxr-xr-x 1 root root 18176 Apr 4 2022 [01;32mRecoverMe02[0m
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:16:12 $ sha[K[K[Kmd5sum *
|
|||
|
|
[?2004l
4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01
|
|||
|
|
d077210a712800925e7b8050cd4d7dff RecoverMe02
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:16:31 $ shasum *
|
|||
|
|
[?2004l
0c6ca93f774b564381a4eedcd52abdec4aadf9fa RecoverMe01
|
|||
|
|
609426581be3c6c495a2f8567b2af78769f9bd3f RecoverMe02
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:16:37 $ xxd Recover[K[K[K[K[K[K[K[K[K[K[Kfile *
|
|||
|
|
[?2004l
RecoverMe01: data
|
|||
|
|
RecoverMe02: data
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:16:57 $ xxd RecoverMe01 | head
|
|||
|
|
[?2004l
00000000: 0fd8 ffe1 274f 4578 6966 0000 4949 2a00 ....'OExif..II*.
|
|||
|
|
00000010: 0800 0000 1000 0001 0300 0100 0000 3b07 ..............;.
|
|||
|
|
00000020: 0000 0101 0300 0100 0000 9509 0000 0201 ................
|
|||
|
|
00000030: 0300 0300 0000 ce00 0000 0601 0300 0100 ................
|
|||
|
|
00000040: 0000 0200 0000 0f01 0200 0600 0000 d400 ................
|
|||
|
|
00000050: 0000 1001 0200 1000 0000 da00 0000 1201 ................
|
|||
|
|
00000060: 0300 0100 0000 0100 0000 1501 0300 0100 ................
|
|||
|
|
00000070: 0000 0300 0000 1a01 0500 0100 0000 ea00 ................
|
|||
|
|
00000080: 0000 1b01 0500 0100 0000 f200 0000 2801 ..............(.
|
|||
|
|
00000090: 0300 0100 0000 0200 0000 3101 0200 1c00 ..........1.....
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:17:12 $ xxd RecoverMe01 | head[1P[1@2
|
|||
|
|
[?2004l
00000000: 8950 4e77 0d0a 1a0a 0000 000d 4948 4452 .PNw........IHDR
|
|||
|
|
00000010: 0000 014a 0000 006e 0802 0000 00ce 01cd ...J...n........
|
|||
|
|
00000020: c600 0000 2063 4852 4d00 007a 2600 0080 .... cHRM..z&...
|
|||
|
|
00000030: 8400 00fa 0000 0080 e800 0075 3000 00ea ...........u0...
|
|||
|
|
00000040: 6000 003a 9800 0017 709c ba51 3c00 0000 `..:....p..Q<...
|
|||
|
|
00000050: 0662 4b47 4400 ff00 ff00 ffa0 bda7 9300 .bKGD...........
|
|||
|
|
00000060: 0000 0774 494d 4507 e101 0d08 0008 de0e ...tIME.........
|
|||
|
|
00000070: 4a60 0000 4676 4944 4154 78da ed9d 677c J`..FvIDATx...g|
|
|||
|
|
00000080: 1dc5 d5f0 cfcc 6cbd fdea aa4b 9664 d9b2 ......l....K.d..
|
|||
|
|
00000090: dc7b 036c d3c1 7463 7a4c 0b84 d009 a61a .{.l..tczL......
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:17:20 $ cd ..
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:17:33 $ mkdir extracted
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:17:38 $ cp mnt/* extracted/
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:17:47 $ cd extracted/
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:17:50 $ md5sum *
|
|||
|
|
[?2004l
4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01
|
|||
|
|
d077210a712800925e7b8050cd4d7dff RecoverMe02
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:17:54 $ hexeditor RecoverMe01
|
|||
|
|
[?2004l
[?1049h[22;0;0t[1;62r(B[m[4l[?7h[39;49m[?1h=[39;49m[37m[40m[H[2J(B[0;1m[33m[46mFile: RecoverMe01[54X[1;72HASCII Offset: 0x0[7b / 0x00181D87 (%00)[K (B[m[39;49m[37m[40m
[62d(B[0;1m[34m[40m^G Help ^C Exit (No Save) ^T goTo Offset ^X Exit and Save ^W Search ^U Undo ^L Redraw ^E Text Mode(B[m[39;49m[37m[40m
[2d[37m[44m0[7b 0F D8 FF E1 27 4F 45 78 69 66 00 00 49 49 2A 00[40X[2;102H....'OExif..II*.[3;1H00000010 08 00 00 00 10 00 00 01 03 00 01 00 00 00 3B 07[40X[3;102H.[13b;.[4;1H00000020 00 00 01 01 03 00 01 00 00 00 95 09 00 00 02 01[40X[4;102H.[14b.[5;1H00000030 03 00 03 00 00 00 CE 00 00 00 06 01 03 00 01 00[40X[5;102H.[14b.[6;1H00000040 00 00 02 00 00 00 0F 01 02 00 06 00 00 00 D4 00[40X[6;102H.[14b.[7;1H00000050 00 00 10 01 02 00 10 00 00 00 DA 00 00 00 12 01[40X[7;102H.[14b.[8;1H00000060 03 00 01 00 00 00 01 00 00 00 15 01 03 00 01 00[40X[8;102H.[14b.[9;1H00000070 00 00 03 00 00 00 1A 01 05 00 01 00 00 00 EA 00[40X[9;102H.[14b.[10;1H00000080 00 00 1B 01 05 00 01 00 00 00 F2 00 00 00 28 01[40X[10;102H.[13b(.[11;1H00000090 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1C 00[40X[11;102H.[9b1.....[12;1H000000A0 00 00 FA 00 00 00 32 01 02 00 14 00 00 00 16 01[40X[12;102H......2.[7b.[13;1H000000B0 00 00 3B 01 02 00 10 00 00 00 2A 01 00 00 69 87[40X[13;102H..;.[6b*...i.[14;1H000000C0 04 00 01 00 00 00 3C 01 00 00 25 88 04 00 01 00[40X[14;102H......<...%.....[15;1H000000D0 00 00 8C 03 00 00 78 04 00 00 08 00 08 00 08 00[40X[15;102H......x.[7b.[16;1H000000E0 43 61 6E 6F 6E 00 43 61 6E 6F 6E 20 45 4F 53 20[40X[16;102HCanon.Canon EOS[K
[17d000000F0 31 30 30 30 44 00 00 9F 24 00 10 27 00 00 00 9F[40X[17;102H1000D...$..'....[18;1H00000100 24 00 10 27 00 00 41 64 6F 62 65 20 50 68 6F 74[40X[18;102H$..'..Adobe Phot[19;1H00000110 6F 73 68 6F 70 20 43 53 35 20 57 69 6E 64 6F 77[40X[19;102Hoshop CS5 Window[20;1H00000120 73 00 32 30 31 30 3A 30 39 3A 31 37 20 31 34 3A[40X[20;102Hs.2010:09:17 14:[21;1H00000130 34 34 3A 33 37 00 52 75 64 6F 6C 66 20 53 74 72[40X[21;102H44:37.Rudolf Str[22;1H00000140 69 63 6B 65 72 00 00 00 21 00 9A 82 05 00 01 00[40X[22;102Hicker...!.[5b.[23;1H00000150 00 00 CE 02 00 00 9D 82 05 00 01 00 00 00 D6 02[40X[23;102H.[14b.[24;1H00000160 00 00 22 88 03 00 01 00 00 00 03 00 00 00 27 88[40X[24;102H..".[10b'.[25;1H00000170 03 00 01 00 00 00 C8 00 00 00 30 88 03 00 01 00[40X[25;102H.[9b0.....[26;1H00000180 00 00 00 00 00 00 00 90 07 00 04 00 00 00 30 32[40X[26;102H.[13b02[27;1H00000190 32 31 03 90 02 00 14 00 00 00 DE 02 00 00 04 90[40X[27;102H21.[12b.[28;1H000001A0 02 00 14 00 00 00 F2 02 00 00 01 92 0A 00 01 00[40X[28;102H.[14b.[29;1H000001B0 00 00 06 03 00 00 02 92 05 00 01 00 00 00 0E 03[40X[29;102H.[14b.[30;1H000001C0 00 00 04 92 0A 00 01 00 00 00 16 03 00 00 05 92[40X[30;102H.[14b.[31;1H000001D0 05 00 01 00 00 00 1E 03 00 00 06 92 05 00 01 00[40X[31;102H.[14b.[32;1H000001E0 00 00 26 03 00 00 07 92 03 00 01 00 00 00 02 00[40X[32;102H..&.[11b.[33;1H000001F0 00 00 09 92 03 00 01 00 00 00 10 00 00 00 0A 92[40X[33;102H.[14b.[34;1H00000200 05 00 01 00 00 00 2E 03 00 00 90 92 02 00 03 00[40X[34;102H.[14b.[35;1H00000210 00 00 39 34 00 00 91 92 02 00 03 00 00 00 39 34[40X[35;102H..94.[9b94[36;1H00000220 00 00 92 92 02 00 03 00 00 00 39 34 00 00 01 A0[40X[36;102H.[9b94....[37;1H00000230 03 00 01 00 00 00 01 00 00 00 02 A0 04 00 01 00[40X[37;102H.[14b.[38;1H00000240 00 00 69 06 00 00 03 A0 04 00 01 00 00 00 86 08[40X[38;102H..i.[11b.[39;1H00000250 00 00 0E A2 05 00 01 00 00 00 36 03 00 00 0F A2[40X[39;102H.[9b6.....[40;1H00000260 05 00 01 00 00 00 3E 03 00 00 10 A2 03 00 01 00[40X[40;102H......>.[7b.[41;1H00000270 00 00 02 00 00 00 01 A4 03 00 01 00 00 00 00 00[40X[41;102H.[14b.[42;1H00000280 00 00 02 A4 03 00 01
|
|||
|
|
[?2004h2023-04-03 15:18:17 $ file RecoverMe01
|
|||
|
|
[?2004l
RecoverMe01: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=2453, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1000D, orientation=upper-left, width=1851], baseline, precision 8, 1641x2182, components 3
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:18:26 $ file RecoverMe01[5@hexeditor[C[C[C[C[C[C[C[C[C[C[C[C[K2
|
|||
|
|
[?2004l
[?1049h[22;0;0t[1;62r(B[m[4l[?7h[39;49m[?1h=[39;49m[37m[40m[H[2J(B[0;1m[33m[46mFile: RecoverMe02[54X[1;72HASCII Offset: 0x0[7b / 0x000046FF (%00)[K (B[m[39;49m[37m[40m
[62d(B[0;1m[34m[40m^G Help ^C Exit (No Save) ^T goTo Offset ^X Exit and Save ^W Search ^U Undo ^L Redraw ^E Text Mode(B[m[39;49m[37m[40m
[2d[37m[44m0[7b 89 50 4E 77 0D 0A 1A 0A 00 00 00 0D 49 48 44 52[40X[2;102H.PNw.[7bIHDR[3;1H00000010 00 00 01 4A 00 00 00 6E 08 02 00 00 00 CE 01 CD[40X[3;102H...J...n.[6b.[4;1H00000020 C6 00 00 00 20 63 48 52 4D 00 00 7A 26 00 00 80[40X[4;102H.... cHRM..z&...[5;1H00000030 84 00 00 FA 00 00 00 80 E8 00 00 75 30 00 00 EA[40X[5;102H.[10bu0...[6;1H00000040 60 00 00 3A 98 00 00 17 70 9C BA 51 3C 00 00 00[40X[6;102H`..:....p..Q<...[7;1H00000050 06 62 4B 47 44 00 FF 00 FF 00 FF A0 BD A7 93 00[40X[7;102H.bKGD.[9b.[8;1H00000060 00 00 07 74 49 4D 45 07 E1 01 0D 08 00 08 DE 0E[40X[8;102H...tIME.[7b.[9;1H00000070 4A 60 00 00 46 76 49 44 41 54 78 DA ED 9D 67 7C[40X[9;102HJ`..FvIDATx...g|[10;1H00000080 1D C5 D5 F0 CF CC 6C BD FD EA AA 4B 96 64 D9 B2[40X[10;102H......l....K.d..[11;1H00000090 DC 7B 03 6C D3 C1 74 63 7A 4C 0B 84 D0 09 A6 1A[40X[11;102H.{.l..tczL......[12;1H000000A0 08 25 24 04 52 20 84 07 02 84 84 D0 42 0F 04 D3[40X[12;102H.%$.R ......B...[13;1H000000B0 6C 8A 8D B1 8D 0B EE BD CA 92 2D AB 4B B7 DF ED[40X[13;102Hl.[8b-.K...[14;1H000000C0 33 EF 87 B9 BA 96 8D 4C 78 F3 90 D7 BC CE FE 3F[40X[14;102H3......Lx......?[15;1H000000D0 E8 A7 BB 3B 3B 33 3B BB 67 67 E6 CC 99 73 D0 E0[40X[15;102H...;;3;.gg...s..[16;1H000000E0 63 6E 02 17 17 97 C3 11 7C A8 2B E0 E2 E2 F2 9F[40X[16;102Hcn......|.+.....[17;1H000000F0 C2 15 6F 17 97 C3 16 57 BC 5D 5C 0E 5B 5C F1 76[40X[17;102H..o....W.]\.[\.v[18;1H00000100 71 39 6C 71 C5 DB C5 E5 B0 C5 15 6F 17 97 C3 16[40X[18;102Hq9lq.[6bo....[19;1H00000110 57 BC 5D 5C 0E 5B 5C F1 76 71 39 6C 71 C5 DB C5[40X[19;102HW.]\.[\.vq9lq...[20;1H00000120 E5 B0 C5 15 6F 17 97 C3 16 57 BC 5D 5C 0E 5B 5C[40X[20;102H....o....W.]\.[\[21;1H00000130 F1 76 71 39 6C 11 0E 75 05 FE E3 10 82 11 42 08[40X[21;102H.vq9l..u......B.[22;1H00000140 01 00 00 03 DB A1 8C B1 FF 54 59 18 23 9C 2D 0A[40X[22;102H.[8bTY.#.-.[23;1H00000150 10 B2 6D E7 7B 2F AB C7 ED 20 C6 98 6D 3B FF FB[40X[23;102H..m.{/... ..m;..[24;1H00000160 3C 05 82 21 9B 25 30 06 8E E3 FC C7 5A E8 87 48[40X[24;102H<..!.%0.....Z..H[25;1H00000170 CF 37 84 31 70 6C E7 7B B9 7B 8C 31 00 A3 F4 50[40X[25;102H.7.1pl.{.{.1...P[26;1H00000180 36 E5 61 2E DE 08 20 9E C8 58 B6 63 DB 0E 20 C0[40X[26;102H6.a... ..X.c.. .[27;1H00000190 08 05 FC 1E 49 14 FE 13 12 CE 18 4B A6 35 C3 B4[40X[27;102H....I......K.5..[28;1H000001A0 1C 87 02 00 65 2C 2F E4 13 85 EF B9 AC 78 22 6D[40X[28;102H....e,/......x"m[29;1H000001B0 D9 94 4B B5 20 E0 50 C0 DB FD E9 FA F7 AB DD 15[40X[29;102H..K. .P.[7b.[30;1H000001C0 4F 53 87 DA 8E C3 18 08 04 07 FC 1E 41 C0 FF 25[40X[30;102HOS.[9bA..%[31;1H000001D0 12 CE 18 8B 27 32 B6 ED 58 B6 03 00 84 E0 50 C0[40X[31;102H....'2..X.....P.[32;1H000001E0 83 F1 FF 76 54 8B 10 CA 68 86 40 B0 F8 9F 79 D9[40X[32;102H...vT...h.@...y.[33;1H000001F0 BE 23 87 B3 78 23 04 B6 43 4F 3B 61 4C 71 61 B8[40X[33;102H.#..x#..CO;aLqa.[34;1H00000200 28 12 64 C0 0C C3 FE E0 F3 15 BB 1B DB BF F7 46[40X[34;102H(.d.[11bF[35;1H00000210 67 8C 49 A2 30 71 4C 6D 75 45 51 38 E8 45 08 29[40X[35;102Hg.I.0qLmuEQ8.E.)[36;1H00000220 B2 F8 E2 5B 5F 34 B7 46 25 E9 7B 2B 8B 31 38 F3[40X[36;102H...[_4.F%.{+.18.[37;1H00000230 E4 F1 85 F9 A1 C2 BC 00 C6 A8 AD 33 F1 F6 87 4B[40X[37;102H.[10b3...K[38;1H00000240 0C C3 C4 18 FD 7B 25 30 C6 44 51 38 FF 8C A3 02[40X[38;102H.....{%0.DQ8....[39;1H00000250 3E B5 20 12 10 04 D2 15 4D CE FE F4 EB AE 68 4A[40X[39;102H>. .....M.....hJ[40;1H00000260 10 C8 21 7C 2F FF DF C0 18 53 15 F9 B8 49
|
|||
|
|
[?2004h2023-04-03 15:18:38 $ file RecoverMe02
|
|||
|
|
[?2004l
RecoverMe02: PNG image data, 330 x 110, 8-bit/color RGB, non-interlaced
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:18:47 $ md5sum *
|
|||
|
|
[?2004l
af0435708c94ccb8bcf77d7fb0aaa14b RecoverMe01
|
|||
|
|
ffb226fe0470ef237b23036fef753a88 RecoverMe02
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:18:53 $ shasum *
|
|||
|
|
[?2004l
e509340c282b1cd66eedd17d9d1207cd53785005 RecoverMe01
|
|||
|
|
572062f974824e7fb14b624922992dd3c06062c7 RecoverMe02
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:18:58 $ cd ..
|
|||
|
|
[?2004l
|
|||
|
|
[?2004h2023-04-03 15:19:00 $ md5sum U2.img
|
|||
|
|
[?2004l
34126162163acea9b3e8130ac09f5340 U2.img
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:19:35 $ md5sum U2.img[1P[1P[1P[C[1@s[1@h[1@a
|
|||
|
|
[?2004l
e809c3186acc3e8fadfa8feb2c5decad17d147fe U2.img
|
|||
|
|
|
|||
|
|
[?2004h2023-04-03 15:20:25 $ exit
|
|||
|
|
[?2004l
exit
|
|||
|
|
|
|||
|
|
Script done on 2023-04-03 15:20:30+02:00 [COMMAND_EXIT_CODE="0"]
|