Recover damage pictures to see the crime scene

Few people know that when you take photos there is also a thumbnail embeded inside the file, even some forensic guys may have no idea about this important clue. That means if you see a damaged photo, you could try to extract the thumbnail inside the photo, thus you could see it clearly. Let me show you how to do it manually with Winhex.

1. A damaged photo, some part of it is missing, so we could not see the face of our suspect clearly...

 

2.Open it with Winhex, and search hex value "FFD8FF" which means the file header of JPGs. There are two hits, and the second one is the header of thumbnamil we're looking for.

 

3. Go to the second hit and mark it as the begining of block.

 

4.Search hex value "FFD9" which means the footer of JPGs and go to the footer of thumbnail we're looking for. Also mark it as the end of block. 

 

5. Now we could copy this block into a new file.

 

6. That's it. Now you could see the face of our suspect, including the weapon on his/her hans and viechle...

 

7. Of course some tools could do this for you, still you have to know why and how and take it into practice.