Script started on 2023-04-03 15:13:44+02:00 [COMMAND="bash" TERM="xterm-256color" TTY="/dev/pts/0" COLUMNS="117" LINES="62"] 2023-04-03 15:13:44 $ ls -la total 9512 drwxr-xr-x 2 mark mark 4096 Apr 3 15:11 . drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 .. -rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 U2.zip 2023-04-03 15:13:48 $ file U2.zip U2.zip: Zip archive data, at least v4.5 to extract, compression method=deflate 2023-04-03 15:13:55 $ md5sum U2.zip 31e8feb8e5a501e5302a7ac983336a24 U2.zip 2023-04-03 15:14:02 $ shasum U2.zip 409499f04d7bb853cc12991f209bad2d58478cf8 U2.zip 2023-04-03 15:14:08 $ unzip U2.zip Archive: U2.zip inflating: U2.img 2023-04-03 15:15:05 $ ls -la total 8201516 drwxr-xr-x 2 mark mark 4096 Apr 3 15:14 . drwxr-xr-x 4 mark mark 4096 Apr 3 15:12 .. -rw-rw-r-- 1 mark mark 8388608000 Apr 4 2022 U2.img -rw-r--r-- 1 mark mark 9730974 Apr 3 14:41 U2.zip 2023-04-03 15:15:24 $ file U2.img U2.img: DOS/MBR boot sector, code offset 0x58+2, OEM-ID "mkfs.fat", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, sectors 16384000 (volumes > 32 MB), FAT (32 bit), sectors/FAT 15976, serial number 0x61d3b3ac, unlabeled 2023-04-03 15:15:30 $ fdisk -l U2.img Disk U2.img: 7.81 GiB, 8388608000 bytes, 16384000 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 2023-04-03 15:15:39 $ mkdir mnt 2023-04-03 15:15:43 $ sudo mount -o ro U2.img mnt [sudo] password for mark: 2023-04-03 15:16:05 $ cd mnt 2023-04-03 15:16:10 $ ls -la total 1572 drwxr-xr-x 2 root root 4096 Jan 1 1970 . drwxr-xr-x 3 mark mark 4096 Apr 3 15:15 .. -rwxr-xr-x 1 root root 1580424 Apr 4 2022 RecoverMe01 -rwxr-xr-x 1 root root 18176 Apr 4 2022 RecoverMe02 2023-04-03 15:16:12 $ md5sum * 4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01 d077210a712800925e7b8050cd4d7dff RecoverMe02 2023-04-03 15:16:31 $ shasum * 0c6ca93f774b564381a4eedcd52abdec4aadf9fa RecoverMe01 609426581be3c6c495a2f8567b2af78769f9bd3f RecoverMe02 2023-04-03 15:16:37 $ file * RecoverMe01: data RecoverMe02: data 2023-04-03 15:16:57 $ xxd RecoverMe01 | head 00000000: 0fd8 ffe1 274f 4578 6966 0000 4949 2a00 ....'OExif..II*. 00000010: 0800 0000 1000 0001 0300 0100 0000 3b07 ..............;. 00000020: 0000 0101 0300 0100 0000 9509 0000 0201 ................ 00000030: 0300 0300 0000 ce00 0000 0601 0300 0100 ................ 00000040: 0000 0200 0000 0f01 0200 0600 0000 d400 ................ 00000050: 0000 1001 0200 1000 0000 da00 0000 1201 ................ 00000060: 0300 0100 0000 0100 0000 1501 0300 0100 ................ 00000070: 0000 0300 0000 1a01 0500 0100 0000 ea00 ................ 00000080: 0000 1b01 0500 0100 0000 f200 0000 2801 ..............(. 00000090: 0300 0100 0000 0200 0000 3101 0200 1c00 ..........1..... 2023-04-03 15:17:12 $ xxd RecoverMe02 | head 00000000: 8950 4e77 0d0a 1a0a 0000 000d 4948 4452 .PNw........IHDR 00000010: 0000 014a 0000 006e 0802 0000 00ce 01cd ...J...n........ 00000020: c600 0000 2063 4852 4d00 007a 2600 0080 .... cHRM..z&... 00000030: 8400 00fa 0000 0080 e800 0075 3000 00ea ...........u0... 00000040: 6000 003a 9800 0017 709c ba51 3c00 0000 `..:....p..Q<... 00000050: 0662 4b47 4400 ff00 ff00 ffa0 bda7 9300 .bKGD........... 00000060: 0000 0774 494d 4507 e101 0d08 0008 de0e ...tIME......... 00000070: 4a60 0000 4676 4944 4154 78da ed9d 677c J`..FvIDATx...g| 00000080: 1dc5 d5f0 cfcc 6cbd fdea aa4b 9664 d9b2 ......l....K.d.. 00000090: dc7b 036c d3c1 7463 7a4c 0b84 d009 a61a .{.l..tczL...... 2023-04-03 15:17:20 $ cd .. 2023-04-03 15:17:33 $ mkdir extracted 2023-04-03 15:17:38 $ cp mnt/* extracted/ 2023-04-03 15:17:47 $ cd extracted/ 2023-04-03 15:17:50 $ md5sum * 4b9078de2f92dee8c9dcc9a50ad2cf7e RecoverMe01 d077210a712800925e7b8050cd4d7dff RecoverMe02 2023-04-03 15:17:54 $ hexeditor RecoverMe01 2023-04-03 15:18:17 $ file RecoverMe01 RecoverMe01: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=2453, bps=206, PhotometricInterpretation=RGB, manufacturer=Canon, model=Canon EOS 1000D, orientation=upper-left, width=1851], baseline, precision 8, 1641x2182, components 3 2023-04-03 15:18:26 $ hexeditor RecoverMe02 2023-04-03 15:18:38 $ file RecoverMe02 RecoverMe02: PNG image data, 330 x 110, 8-bit/color RGB, non-interlaced 2023-04-03 15:18:47 $ md5sum * af0435708c94ccb8bcf77d7fb0aaa14b RecoverMe01 ffb226fe0470ef237b23036fef753a88 RecoverMe02 2023-04-03 15:18:53 $ shasum * e509340c282b1cd66eedd17d9d1207cd53785005 RecoverMe01 572062f974824e7fb14b624922992dd3c06062c7 RecoverMe02 2023-04-03 15:18:58 $ cd .. 2023-04-03 15:19:00 $ md5sum U2.img 34126162163acea9b3e8130ac09f5340 U2.img 2023-04-03 15:19:35 $ shasum U2.img e809c3186acc3e8fadfa8feb2c5decad17d147fe U2.img 2023-04-03 15:20:25 $ exit exit Script done on 2023-04-03 15:20:30+02:00 [COMMAND_EXIT_CODE="0"]