How to carve TIFF files

[DRCRecoveryData]

Hi,

I'm learning how to carve cr2 file in python is success before end of each files is same header signature.

But i don't know how to carve NEF/ARW files because the header: 49 49 2A 00 08 00 00 00 is 3 places in file could you explain how to crave tiff structure?

[cgsecurity]

Can you share a file sample where you have this problem ?

[DRCRecoveryData]

Can you share a file sample where you have this problem ?

Hi, I'm learning to carve CR2 and NEF file from a dump physical sector to sector , i success to carve CR2 but NEF i don't know how to carve it CR2:

import os

def find_cr2_files(input_file, output_dir):
    cr2_signature = binascii.unhexlify('49492A0010000000')  # CR2 file signature in hexadecimal

    with open(input_file, 'rb') as f:
        file_size = os.path.getsize(input_file)

        # Read the entire file into memory for faster processing
        data = f.read()

    index = 0
    file_number = 1

    while True:
        # Find the next occurrence of CR2 file header
        index = data.find(cr2_signature, index)
        if index == -1:
            break
        
        # Determine the start and end positions of the CR2 file
        start_offset = index
        end_index = data.find(cr2_signature, start_offset + 1)

        if end_index == -1:
            end_offset = file_size  # If no next signature, take till end of file
        else:
            end_offset = end_index

        # Extract the CR2 file data
        cr2_data = data[start_offset:end_offset]

        # Generate filename based on offset
        offset_hex = hex(start_offset)
        output_filename = f'0x{offset_hex[2:].zfill(8)}.cr2'  # Example: 0x12345678.cr2

        # Write the CR2 file to output directory
        output_file = os.path.join(output_dir, output_filename)
        with open(output_file, 'wb') as cr2_file:
            cr2_file.write(cr2_data)

        print(f'Extracted CR2 file {file_number} to {output_file}')

        # Move index forward to search for the next CR2 file
        index = end_offset
        file_number += 1

if __name__ == "__main__":
    # Prompt user for input file path
    input_file = input("Enter the path to the binary image file containing CR2 files: ").strip()

    # Ensure the input file exists
    if not os.path.isfile(input_file):
        print(f"Error: File '{input_file}' not found.")
        exit(1)

    # Create output directory
    output_dir = 'Carved'  # Replace with your desired output directory
    if not os.path.exists(output_dir):
        os.makedirs(output_dir)

    # Call function to find and extract CR2 files
    find_cr2_files(input_file, output_dir)

In CR2 only have one signature from header:

But in NEF i don't know how to carve it beause NEF have many header signature in file

Sample: https://drive.google.com/file/d/1VH_B12eWnnbKjtbY-qSOAcQirEpPvIh7/view?usp=sharing