cyber forensics recover files

Description

I have to recover files but i am having trouble getting the logical and physical size to be able to use dd for the recovery can i get some help?

I can paste the result of the command xxd 4860.sp24.a2.dd which is :

00002600: 4131 0074 0065 0073 0074 000f 00b1 6400 A1.t.e.s.t….d.

00002610: 6400 2e00 7400 7800 7400 0000 0000 ffff d…t.x.t…….

00002620: 3154 4553 5444 4420 5458 5420 008d b5a1 1TESTDD TXT ….

00002630: ce52 ce52 0000 b5a1 ce52 0300 2001 0000 .R.R…..R.. …

00002640: 4132 0075 0073 0065 0066 000f 005a 7500 A2.u.s.e.f…Zu.

00002650: 6c00 2e00 6400 6f00 6300 0000 7800 0000 l…d.o.c…x…

00002660: 3255 5345 4655 7e31 444f 4320 004d bba1 2USEFU~1DOC .M..

00002670: ce52 ce52 0000 bba1 ce52 0400 6533 0000 .R.R…..R..e3..

00002680: e533 0077 0069 006e 0075 000f 00fb 7000 .3.w.i.n.u….p.

00002690: 2e00 6a00 7000 6700 0000 0000 ffff ffff ..j.p.g………

000026a0: e557 494e 5550 2020 4a50 4720 0075 e0a1 .WINUP JPG .u..

000026b0: ce52 ce52 0000 e0a1 ce52 1e00 a800 0100 .R.R…..R……

000026c0: e534 0063 0079 0062 0065 000f 00a1 7200 .4.c.y.b.e….r.

000026d0: 2e00 7000 6400 6600 0000 0000 ffff ffff ..p.d.f………

000026e0: e543 5942 4552 2020 5044 4620 001a e8a1 .CYBER PDF ….

000026f0: ce52 ce52 0000 e8a1 ce52 9f00 eee7 0000 .R.R…..R……

00002700: e535 0066 006c 0073 006a 000f 0011 2e00 .5.f.l.s.j……

00002710: 7000 6e00 6700 0000 ffff 0000 ffff ffff p.n.g………..

00002720: e546 4c53 4a20 2020 504e 4720 007e eca1 .FLSJ PNG .~..

00002730: ce52 ce52 0000 eca1 ce52 1301 133e 0800 .R.R…..R…>..

00002740: 0000 0000 0000 0000 0000 0000 0000 0000 …..

can we at least do one I would like to learn more about this method to recover files. if I understand correctly, number 3 file is

00002680: e533 0077 0069 006e 0075 000f 00fb 7000 .3.w.i.n.u….p.

00002690: 2e00 6a00 7000 6700 0000 0000 ffff ffff ..j.p.g………

000026a0: e557 494e 5550 2020 4a50 4720 0075 e0a1 .WINUP JPG .u..

000026b0: ce52 ce52 0000 e0a1 ce52 1e00 a800 0100 .R.R…..R……

I would take a800 0100 to calculate the logical size and then swap them to 00a8 0001 which equals to 11610064?

Get your college paper done by experts

Do my question How much will it cost?

Place an order in 3 easy steps. Takes less than 5 mins.