[Solved] Trying to grep a hex pattern from a binary dump - not working

Question

Hi all, I'm not sure if this is the right forum but as it is related to a scripting course I'm doing I couldn't see anywhere more suitable.
I have a raw disk dump that contains several jpeg images etc...  I'm trying to make a carving utility to extract the images using bash and ultimately grep to do the heavy lifting.
What I'm trying to do is to grep hex escaped character values within the raw disk dump to find the location where a jpeg image starts.  The jpeg image file header in hex is "ffd8ff".  The most straight forward example I could find for how to achieve this was from here: http://www.commandlinefu.com/commands/v … l-patterns
According to that page I should be able to execute grep -P "\xff\xd8\xff" diskdump.raw in order to be able to get some sort of match, however in spite of my certainty that there are a number of jpeg images in the disk dump (I created the disk dump) and the fact that I can use hex dump utilities to confirm the presence of the matching header grep is refusing to play ball and acknowledge a match. I don't know what to do, other people on the course are able to use grep this way with different distributions.
Does anyone know if this is a known issue, has anyone come across it before and, better yet, does anyone know how I can get grep to bend to my will on Arch?
Thanks in advance,
B
Last edited by Baz_ (2015-04-03 08:55:11)

Answer 1

Trilby wrote:
I think you'll need the -a flag for grep (unless you use ewaller's od approach):
man grep wrote:-a, --text
        Process a binary file as if it were text; this is equivalent to the --binary-files=text option.
I have tried "grep -a ...", "grep -Pa ..." and the version that works for my class mate "grep -obPa ..." plus several other variations of the above and none of them work.
I have a working version of a carver similar to ewaller's idea using a hexdump utility (xxd) rather than od but because of the fact that the header and footer could roll over from one line to another it is extremely inefficient as it requires two searches through the file to ensure that you have found the earliest header (the second search pads a few characters to the front of the raw dump depending on the size of the header).
The ability to search for a string of characters by their hex values with grep would lead to much more efficient code.
I don't suppose grep is due an update soon that might cause it to do what I want? Or even better is someone knows how to get grep as it stands to do what I want?
Thanks for your posts so far guys, much appreciated.
B