Script started on 2023-04-03 15:13:44+02:00 [COMMAND="bash" TERM="xterm-256color" TTY="/dev/pts/0" COLUMNS="117" LINES="62"] [?2004h2023-04-03 15:13:44 $ ls -la [?2004l total 9512 drwxr-xr-x 2 mark mark 4096 Apr 3 15:11 . drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 .. -rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 U2.zip [?2004h2023-04-03 15:13:48 $ file U2.zip [?2004l U2.zip: Zip archive data, at least v4.5 to extract, compression method=deflate [?2004h2023-04-03 15:13:55 $ md5sum U2.zip [?2004l 31e8feb8e5a501e5302a7ac983336a24 U2.zip [?2004h2023-04-03 15:14:02 $ shasum U2.zip [?2004l 409499f04d7bb853cc12991f209bad2d58478cf8 U2.zip [?2004h2023-04-03 15:14:08 $ unzip U2.zip [?2004l Archive: U2.zip inflating: U2.img [?2004h2023-04-03 15:15:05 $ ls -la [?2004l total 8201516 drwxr-xr-x 2 mark mark 4096 Apr 3 15:14 . drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 .. -rw-rw-r-- 1 mark mark 8388608000 Apr 4 2022 U2.img -rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 U2.zip [?2004h2023-04-03 15:15:24 $ file U2.img [?2004l U2.img: DOS/MBR boot sector, code offset 0x58+2, OEM-ID "mkfs.fat", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, sectors 16384000 (volumes > 32 MB), FAT (32 bit), sectors/FAT 15976, serial number 0x61d3b3ac, unlabeled [?2004h2023-04-03 15:15:30 $ fdisk -l U2.img [?2004l Disk U2.img: 7.81 GiB, 8388608000 bytes, 16384000 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 [?2004h2023-04-03 15:15:39 $ mkdir mnt [?2004l [?2004h2023-04-03 15:15:43 $ sudo mount u2.U2.img mnt[1@-[1@o[1@ [1@r[1@o[1@ [?2004l [sudo] password for mark: [?2004h2023-04-03 15:16:05 $ cd mnt [?2004l [?2004h2023-04-03 15:16:10 $ ls -la [?2004l total 1572 drwxr-xr-x 2 root root 4096 Jan 1 1970 . drwxr-xr-x 3 mark mark 4096 Apr 3 15:15 .. -rwxr-xr-x 1 root root 1580424 Apr 4 2022 RecoverMe01 -rwxr-xr-x 1 root root 18176 Apr 4 2022 RecoverMe02 [?2004h2023-04-03 15:16:12 $ shamd5sum * [?2004l 4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01 d077210a712800925e7b8050cd4d7dff RecoverMe02 [?2004h2023-04-03 15:16:31 $ shasum * [?2004l 0c6ca93f774b564381a4eedcd52abdec4aadf9fa RecoverMe01 609426581be3c6c495a2f8567b2af78769f9bd3f RecoverMe02 [?2004h2023-04-03 15:16:37 $ xxd Recoverfile * [?2004l RecoverMe01: data RecoverMe02: data [?2004h2023-04-03 15:16:57 $ xxd RecoverMe01 | head [?2004l 00000000: 0fd8 ffe1 274f 4578 6966 0000 4949 2a00 ....'OExif..II*. 00000010: 0800 0000 1000 0001 0300 0100 0000 3b07 ..............;. 00000020: 0000 0101 0300 0100 0000 9509 0000 0201 ................ 00000030: 0300 0300 0000 ce00 0000 0601 0300 0100 ................ 00000040: 0000 0200 0000 0f01 0200 0600 0000 d400 ................ 00000050: 0000 1001 0200 1000 0000 da00 0000 1201 ................ 00000060: 0300 0100 0000 0100 0000 1501 0300 0100 ................ 00000070: 0000 0300 0000 1a01 0500 0100 0000 ea00 ................ 00000080: 0000 1b01 0500 0100 0000 f200 0000 2801 ..............(. 00000090: 0300 0100 0000 0200 0000 3101 0200 1c00 ..........1..... [?2004h2023-04-03 15:17:12 $ xxd RecoverMe01 | head[1@2 [?2004l 00000000: 8950 4e77 0d0a 1a0a 0000 000d 4948 4452 .PNw........IHDR 00000010: 0000 014a 0000 006e 0802 0000 00ce 01cd ...J...n........ 00000020: c600 0000 2063 4852 4d00 007a 2600 0080 .... cHRM..z&... 00000030: 8400 00fa 0000 0080 e800 0075 3000 00ea ...........u0... 00000040: 6000 003a 9800 0017 709c ba51 3c00 0000 `..:....p..Q<... 00000050: 0662 4b47 4400 ff00 ff00 ffa0 bda7 9300 .bKGD........... 00000060: 0000 0774 494d 4507 e101 0d08 0008 de0e ...tIME......... 00000070: 4a60 0000 4676 4944 4154 78da ed9d 677c J`..FvIDATx...g| 00000080: 1dc5 d5f0 cfcc 6cbd fdea aa4b 9664 d9b2 ......l....K.d.. 00000090: dc7b 036c d3c1 7463 7a4c 0b84 d009 a61a .{.l..tczL...... [?2004h2023-04-03 15:17:20 $ cd .. [?2004l [?2004h2023-04-03 15:17:33 $ mkdir extracted [?2004l [?2004h2023-04-03 15:17:38 $ cp mnt/* extracted/ [?2004l [?2004h2023-04-03 15:17:47 $ cd extracted/ [?2004l [?2004h2023-04-03 15:17:50 $ md5sum * [?2004l 4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01 d077210a712800925e7b8050cd4d7dff RecoverMe02 [?2004h2023-04-03 15:17:54 $ hexeditor RecoverMe01 [?2004l [?1049h(B[?7h[?1h=(BFile: RecoverMe01ASCII Offset: 0x0 / 0x00181D87 (%00) (B (B^G Help ^C Exit (No Save) ^T goTo Offset ^X Exit and Save ^W Search ^U Undo ^L Redraw ^E Text Mode(B 0 0F D8 FF E1 27 4F 45 78 69 66 00 00 49 49 2A 00....'OExif..II*.00000010 08 00 00 00 10 00 00 01 03 00 01 00 00 00 3B 07.;.00000020 00 00 01 01 03 00 01 00 00 00 95 09 00 00 02 01..00000030 03 00 03 00 00 00 CE 00 00 00 06 01 03 00 01 00..00000040 00 00 02 00 00 00 0F 01 02 00 06 00 00 00 D4 00..00000050 00 00 10 01 02 00 10 00 00 00 DA 00 00 00 12 01..00000060 03 00 01 00 00 00 01 00 00 00 15 01 03 00 01 00..00000070 00 00 03 00 00 00 1A 01 05 00 01 00 00 00 EA 00..00000080 00 00 1B 01 05 00 01 00 00 00 F2 00 00 00 28 01.(.00000090 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1C 00.1.....000000A0 00 00 FA 00 00 00 32 01 02 00 14 00 00 00 16 01......2..000000B0 00 00 3B 01 02 00 10 00 00 00 2A 01 00 00 69 87..;.*...i.000000C0 04 00 01 00 00 00 3C 01 00 00 25 88 04 00 01 00......<...%.....000000D0 00 00 8C 03 00 00 78 04 00 00 08 00 08 00 08 00......x..000000E0 43 61 6E 6F 6E 00 43 61 6E 6F 6E 20 45 4F 53 20Canon.Canon EOS 000000F0 31 30 30 30 44 00 00 9F 24 00 10 27 00 00 00 9F1000D...$..'....00000100 24 00 10 27 00 00 41 64 6F 62 65 20 50 68 6F 74$..'..Adobe Phot00000110 6F 73 68 6F 70 20 43 53 35 20 57 69 6E 64 6F 77oshop CS5 Window00000120 73 00 32 30 31 30 3A 30 39 3A 31 37 20 31 34 3As.2010:09:17 14:00000130 34 34 3A 33 37 00 52 75 64 6F 6C 66 20 53 74 7244:37.Rudolf Str00000140 69 63 6B 65 72 00 00 00 21 00 9A 82 05 00 01 00icker...!..00000150 00 00 CE 02 00 00 9D 82 05 00 01 00 00 00 D6 02..00000160 00 00 22 88 03 00 01 00 00 00 03 00 00 00 27 88..".'.00000170 03 00 01 00 00 00 C8 00 00 00 30 88 03 00 01 00.0.....00000180 00 00 00 00 00 00 00 90 07 00 04 00 00 00 30 32.0200000190 32 31 03 90 02 00 14 00 00 00 DE 02 00 00 04 9021..000001A0 02 00 14 00 00 00 F2 02 00 00 01 92 0A 00 01 00..000001B0 00 00 06 03 00 00 02 92 05 00 01 00 00 00 0E 03..000001C0 00 00 04 92 0A 00 01 00 00 00 16 03 00 00 05 92..000001D0 05 00 01 00 00 00 1E 03 00 00 06 92 05 00 01 00..000001E0 00 00 26 03 00 00 07 92 03 00 01 00 00 00 02 00..&..000001F0 00 00 09 92 03 00 01 00 00 00 10 00 00 00 0A 92..00000200 05 00 01 00 00 00 2E 03 00 00 90 92 02 00 03 00..00000210 00 00 39 34 00 00 91 92 02 00 03 00 00 00 39 34..94.9400000220 00 00 92 92 02 00 03 00 00 00 39 34 00 00 01 A0.94....00000230 03 00 01 00 00 00 01 00 00 00 02 A0 04 00 01 00..00000240 00 00 69 06 00 00 03 A0 04 00 01 00 00 00 86 08..i..00000250 00 00 0E A2 05 00 01 00 00 00 36 03 00 00 0F A2.6.....00000260 05 00 01 00 00 00 3E 03 00 00 10 A2 03 00 01 00......>..00000270 00 00 02 00 00 00 01 A4 03 00 01 00 00 00 00 00..00000280 00 00 02 A4 03 00 01 00 00 00 00 00 00 00 03 A4..00000290 03 00 01 00 00 00 00 00 00 00 06 A4 03 00 01 00..000002A0 00 00 00 00 00 00 30 A4 02 00 10 00 00 00 46 03......0.F.000002B0 00 00 31 A4 02 00 0B 00 00 00 56 03 00 00 32 A4..1.V...2.000002C0 05 00 04 00 00 00 61 03 00 00 34 A4 02 00 08 00......a...4.....000002D0 00 00 81 03 00 00 00 00 00 00 01 00 00 00 64 00.d.000002E0 00 00 0B 00 00 00 01 00 00 00 32 30 31 30 3A 30.2010:0000002F0 39 3A 31 37 20 30 39 3A 33 37 3A 30 35 00 32 309:17 09:37:05.2000000300 31 30 3A 30 39 3A 31 37 20 30 39 3A 33 37 3A 3010:09:17 09:37:000000310 35 00 90 60 65 00 40 42 0F 00 CF 92 69 00 40 425..`e.@B....i.@B00000320 0F 00 00 00 00 00 01 00 00 00 3B 0B 00 00 E8 03.;.....00000330 00 00 B0 02 00 00 64 00 00 00 17 00 00 00 01 00......d..00000340 00 00 80 53 3B 00 6C 03 00 00 00 8D 27 00 47 02...S;.l.....'.G.00000350 00 00 52 75 64 6F 6C 66 20 53 74 72 69 63 6B 65..Rudolf Stricke00000360 72 00 32 33 35 30 35 36 36 38 32 32 00 11 00 00r.2350566822....00000370 00 01 00 00 00 32 00 00 00 01 00 00 00 00 00 00.....2..00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 31 37 2D.17-00000390 35 30 6D 6D 00 00 00 00 0B 00 00 00 01 00 04 0050mm..000003A0 00 00 02 02 00 00 01 00 02 00 02 00 00 00 4E 00.N.000003B0 00 00 02 00 05 00 03 00 00 00 16 04 00 00 03 00..(B(BM(B(BFF .(B(B/^X/Escape Cancel(B(0lqk(B(0x(BSave File(0x(B(0x(B(0x(B(0x(B Filename: (BRecoverMe01(B (0x(B(0x(B(0x(B(0mqj(B(0(B  [?1049l [?1l> [?2004h2023-04-03 15:18:17 $ file RecoverMe01 [?2004l RecoverMe01: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=2453, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1000D, orientation=upper-left, width=1851], baseline, precision 8, 1641x2182, components 3 [?2004h2023-04-03 15:18:26 $ file RecoverMe01[5@hexeditor2 [?2004l [?1049h(B[?7h[?1h=(BFile: RecoverMe02ASCII Offset: 0x0 / 0x000046FF (%00) (B (B^G Help ^C Exit (No Save) ^T goTo Offset ^X Exit and Save ^W Search ^U Undo ^L Redraw ^E Text Mode(B 0 89 50 4E 77 0D 0A 1A 0A 00 00 00 0D 49 48 44 52.PNw.IHDR00000010 00 00 01 4A 00 00 00 6E 08 02 00 00 00 CE 01 CD...J...n..00000020 C6 00 00 00 20 63 48 52 4D 00 00 7A 26 00 00 80.... cHRM..z&...00000030 84 00 00 FA 00 00 00 80 E8 00 00 75 30 00 00 EA.u0...00000040 60 00 00 3A 98 00 00 17 70 9C BA 51 3C 00 00 00`..:....p..Q<...00000050 06 62 4B 47 44 00 FF 00 FF 00 FF A0 BD A7 93 00.bKGD..00000060 00 00 07 74 49 4D 45 07 E1 01 0D 08 00 08 DE 0E...tIME..00000070 4A 60 00 00 46 76 49 44 41 54 78 DA ED 9D 67 7CJ`..FvIDATx...g|00000080 1D C5 D5 F0 CF CC 6C BD FD EA AA 4B 96 64 D9 B2......l....K.d..00000090 DC 7B 03 6C D3 C1 74 63 7A 4C 0B 84 D0 09 A6 1A.{.l..tczL......000000A0 08 25 24 04 52 20 84 07 02 84 84 D0 42 0F 04 D3.%$.R ......B...000000B0 6C 8A 8D B1 8D 0B EE BD CA 92 2D AB 4B B7 DF EDl.-.K...000000C0 33 EF 87 B9 BA 96 8D 4C 78 F3 90 D7 BC CE FE 3F3......Lx......?000000D0 E8 A7 BB 3B 3B 33 3B BB 67 67 E6 CC 99 73 D0 E0...;;3;.gg...s..000000E0 63 6E 02 17 17 97 C3 11 7C A8 2B E0 E2 E2 F2 9Fcn......|.+.....000000F0 C2 15 6F 17 97 C3 16 57 BC 5D 5C 0E 5B 5C F1 76..o....W.]\.[\.v00000100 71 39 6C 71 C5 DB C5 E5 B0 C5 15 6F 17 97 C3 16q9lq.o....00000110 57 BC 5D 5C 0E 5B 5C F1 76 71 39 6C 71 C5 DB C5W.]\.[\.vq9lq...00000120 E5 B0 C5 15 6F 17 97 C3 16 57 BC 5D 5C 0E 5B 5C....o....W.]\.[\00000130 F1 76 71 39 6C 11 0E 75 05 FE E3 10 82 11 42 08.vq9l..u......B.00000140 01 00 00 03 DB A1 8C B1 FF 54 59 18 23 9C 2D 0A.TY.#.-.00000150 10 B2 6D E7 7B 2F AB C7 ED 20 C6 98 6D 3B FF FB..m.{/... ..m;..00000160 3C 05 82 21 9B 25 30 06 8E E3 FC C7 5A E8 87 48<..!.%0.....Z..H00000170 CF 37 84 31 70 6C E7 7B B9 7B 8C 31 00 A3 F4 50.7.1pl.{.{.1...P00000180 36 E5 61 2E DE 08 20 9E C8 58 B6 63 DB 0E 20 C06.a... ..X.c.. .00000190 08 05 FC 1E 49 14 FE 13 12 CE 18 4B A6 35 C3 B4....I......K.5..000001A0 1C 87 02 00 65 2C 2F E4 13 85 EF B9 AC 78 22 6D....e,/......x"m000001B0 D9 94 4B B5 20 E0 50 C0 DB FD E9 FA F7 AB DD 15..K. .P..000001C0 4F 53 87 DA 8E C3 18 08 04 07 FC 1E 41 C0 FF 25OS.A..%000001D0 12 CE 18 8B 27 32 B6 ED 58 B6 03 00 84 E0 50 C0....'2..X.....P.000001E0 83 F1 FF 76 54 8B 10 CA 68 86 40 B0 F8 9F 79 D9...vT...h.@...y.000001F0 BE 23 87 B3 78 23 04 B6 43 4F 3B 61 4C 71 61 B8.#..x#..CO;aLqa.00000200 28 12 64 C0 0C C3 FE E0 F3 15 BB 1B DB BF F7 46(.d.F00000210 67 8C 49 A2 30 71 4C 6D 75 45 51 38 E8 45 08 29g.I.0qLmuEQ8.E.)00000220 B2 F8 E2 5B 5F 34 B7 46 25 E9 7B 2B 8B 31 38 F3...[_4.F%.{+.18.00000230 E4 F1 85 F9 A1 C2 BC 00 C6 A8 AD 33 F1 F6 87 4B.3...K00000240 0C C3 C4 18 FD 7B 25 30 C6 44 51 38 FF 8C A3 02.....{%0.DQ8....00000250 3E B5 20 12 10 04 D2 15 4D CE FE F4 EB AE 68 4A>. .....M.....hJ00000260 10 C8 21 7C 2F FF DF C0 18 53 15 F9 B8 49 C3 0B..!|/....S...I..00000270 F2 02 C5 05 21 40 90 4C 69 6F 7D B0 24 91 CC 10....!@.Lio}.$...00000280 F2 6F 36 29 CF D6 B6 9D 31 C3 FB 45 E3 E9 DD 8D.o6)....1..E....00000290 6D 82 40 0E D5 0D 1E DE E2 8D 4C D3 BE EB 86 E9m.@.L.....000002A0 7D 4A F3 29 65 18 A3 8C 6E 6E D8 B6 7B C7 AE 66}J.)e...nn..{..f000002B0 59 12 BF C7 01 28 42 C8 71 A8 A2 48 D7 5F 7E CAY....(B.q..H._~.000002C0 98 61 D5 0E A5 C0 80 10 FC C1 67 2B 77 EF 6D 97.a.g+w.m.000002D0 65 E1 FB 2A CA A1 F4 81 5B 2E 88 84 FD 0E A5 04e..*....[..000002E0 E3 BA DD 6D 1F CE 5B A5 EB 06 00 06 F8 77 CA A0...m..[......w..000002F0 94 C9 92 F0 DB 7B 2E 21 04 F3 26 6A 6E 8B 2E 5E.....{.!..&jn..^00000300 B1 B5 AD 23 7E 68 BB 9D FF 07 F0 A7 16 08 78 EF...#~h.x.00000310 BD F9 BC A2 FC 20 A5 14 63 DC D1 95 9C BB 60 6D..... ..c.....`m00000320 2C 9E 22 44 F8 F7 9A 14 21 B0 6C 7A E5 45 27 5C,."D....!.lz.E'\00000330 7B E9 C9 BA 6E DE F5 C8 DF 17 2E DD 28 49 E2 21{...n.(I.!00000340 69 CC C3 59 B5 C6 18 08 84 7C FA E5 DA 05 4B 37i..Y.....|....K700000350 26 52 19 00 D0 75 D3 30 2C 8C D0 F7 DD D2 0C 63&R...u.0,......c00000360 A4 EB E6 67 0B D7 7D BE 68 5D 34 96 72 28 05 80...g..}.h]4.r(..00000370 EF FD 89 62 84 DE F9 68 D9 C2 65 9B 52 69 1D 00...b...h..e.Ri..00000380 BA 27 02 FF FE E0 1C 21 64 D9 CE 9B EF 7F F5 D9.'.....!d..00000390 A2 75 B1 44 1A 00 32 9A 69 59 36 42 E8 DF 7B B9.u.D..2.iY6B..{.000003A0 FF FF 02 21 A4 EB E6 C7 F3 56 2D 5E B1 C5 B6 29...!.....V-^...)000003B0 00 98 96 6D 3B F4 7F 33 DF 61 0C 08 C6 3F 9D 71...m;..3.a...?.q(B(B1(B(B2(B(B3(B(BM(B(B47 G(B(B/^X/Escape Cancel(B(0lqk(B(0x(BSave File(0x(B(0x(B(0x(B(0x(B Filename: (BRecoverMe02(B (0x(B(0x(B(0x(B(0mqj(B(0(B  [?1049l [?1l> [?2004h2023-04-03 15:18:38 $ file RecoverMe02 [?2004l RecoverMe02: PNG image data, 330 x 110, 8-bit/color RGB, non-interlaced [?2004h2023-04-03 15:18:47 $ md5sum * [?2004l af0435708c94ccb8bcf77d7fb0aaa14b RecoverMe01 ffb226fe0470ef237b23036fef753a88 RecoverMe02 [?2004h2023-04-03 15:18:53 $ shasum * [?2004l e509340c282b1cd66eedd17d9d1207cd53785005 RecoverMe01 572062f974824e7fb14b624922992dd3c06062c7 RecoverMe02 [?2004h2023-04-03 15:18:58 $ cd .. [?2004l [?2004h2023-04-03 15:19:00 $ md5sum U2.img [?2004l 34126162163acea9b3e8130ac09f5340 U2.img [?2004h2023-04-03 15:19:35 $ md5sum U2.img[1@s[1@h[1@a [?2004l e809c3186acc3e8fadfa8feb2c5decad17d147fe U2.img [?2004h2023-04-03 15:20:25 $ exit [?2004l exit Script done on 2023-04-03 15:20:30+02:00 [COMMAND_EXIT_CODE="0"]