"Cold Case - Catch a Killer in 16 Bytes"
summary
A Kodak C513 compact camera has 16 megabytes of internal NAND organized as a FAT12 filesystem that can hold up to 41 images; commercial tools (Photorec, Binwalk) and a vendor chip-off image fail to carve files because each 528‑byte page includes a 16‑byte spare area. A DIY chip reader (TNT4 dev board, TL866-style programmer), hex editor and a small C utility that strips the 16‑byte spare per page successfully reconstructs images — yielding 17 pictures.
AI-written summary · about
chapters (30)
- 0:00Intro
- 0:36Disclaimer
- 1:29Iggys background
- 3:15The device
- 3:59The forensics team
- 4:37Photo recovery
- 6:09Magic numbers
- 7:20Wikipedia
- 8:03Hex Editor
- 8:36Magic Number List
- 9:03Boot Record
- 9:37File System
- 10:05Binwalk
- 10:34Im Desperate
- 10:53Red SOX
- 11:32Engineering Requirements
- 12:22Additional Information
- 12:58Taking Photos
- 13:37Xenon Tubes
- 14:35Nand
- 14:57Chip off
- 16:09Data sheet
- 17:02Dev board
- 17:40Writing code
- 18:20Image comparisons
- 19:03File allocation tables
- 20:22File allocation utility
- 21:40What I learned
- 22:47Critical evidence uncovered
- 23:27Hardware hacking
related talks
53mIntel ME: Flash File System Explained
33mBreaking Into Chips By Reading The Datasheet
47mHow To Dump, Parse, And Analyze i.MX Flash Memory Chips
45mReverse Engineering Flash Memory for Fun and Benefit
36m Hashing the $#!+ out of firmware
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
34mCryo-Mechanical RAM Content Extraction: A DIY Cold Boot Robot For A Thousand Bucks
46mDigital Forensics – The Importance of Forensic Triage Images