Google Code Exporter
Google Code Exporter
``` This time it didn't error out in same spot. getAttribute VolcanicPercolatorDaySpa.level fileID=512137 getAttribute VolcanicPercolatorDaySpa.resrc fileID=512138 getAttribute VolcanicPercolatorDaySpa.scene fileID=512139 getAttribute main_l.png fileID=512131 getAttribute main_r.png fileID=512132 getAttribute miniPipeBg.png fileID=512133 getAttribute mixer.png...
``` I edited emf_decrypter.c and uncommented the write back to image line which caused it to crash in same spot with the following error: getAttribute WeatherVane.level fileID=512153 Decrypting WeatherVane.level getAttribute...
``` Ok, can you try changing this line in emf_decrypter.c : -if(READ(emf->volume->image, (extent->startBlock + i) * blockSize, blockSize, buffer), "READ") +if(READ(emf->volume->image, (extent->startBlock + i) * blockSize, blockSize, buffer)) Not sure...
``` This bug has not been fixed yet. You can use the python version of emf_decrypter instead (python_scripts/emf_decrypter.py). ``` Original comment by `[email protected]` on 1 Oct 2011 at 3:46
``` Issue 26 has been merged into this issue. ``` Original comment by `[email protected]` on 14 Oct 2011 at 12:50
``` Indeed this is a tricky question. An idea would be to first look for cprotect attributes of deleted files (using a tool like filexray) and then try each of...
``` Does emf_decrypter extract and decrypt individual files or does it produce a decrypted raw dump that i can use winhex on? ``` Original comment by `[email protected]` on 29 Jun...
``` it decrypts the raw dump "in place" but does not decrypts the unallocated space because this is non-trivial. ``` Original comment by `[email protected]` on 30 Jun 2011 at 8:33
``` Jean, Thank you and your partner for both your hard work. I got all tools to compile and work as described. Hopefully in the future this tool or hfsexplorer...
``` i just committed a proof of concept implementation of a recovery technique using the journal file, based on this paper : http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf http://www.dfrws.org/2008/proceedings/p76-burghardt_pres.pdf It can help recover a few...