Hi,
I was wondering how one would go about the process of reconstructing a JPEG from its fragments. For example, forensics challenge 2 of the CSAW CTF from 2010 involved this task. I looked at the writeup at
http://blog.stalkr.net/2010/09/csaw-ctf-forensics-write-up.html, but couldn't figure out how the order of fragments to use in the command
cat 465893 330404 208409 192959 283415 232579 428750 466450 358848 203839 > 2-reconstructed.jpg was determined. Is it just trial and error, or is there a better strategy?
Thanks,
Sachith