iPhone Forensics

Validating Images with ImageMagick

Recovery tools generally err on the side of generating too much data, rather than skipping files that could be important. As a result, they extract a lot of data that may be partially corrupt or unwanted altogether. Finding valid images to examine can be a time-consuming process in the presence of thousands of files, so a few simple recipes can greatly help reduce the amount of time needed.

The ImageMagick package contains a set of image processing utilities, one of which can be used to display information about images. The identify tool included with ImageMagick is perfect for sifting through the thousands of files created by data-carving tools to identify the readable images. ImageMagick can be downloaded from http://www.imagemagick.org/script/index.php. Mac OS users may build from sources or use MacPorts (http://www.macports.org) to install the package:

$ sudo port install imagemagick

Once installed, write a simple bash script to test the validity of an image file. For the purposes of this example, name the file test-script.sh:

#!/bin/bash
mkdir invalid
identify $1 || mv $1 ./invalid/

Warning

Some images may be corrupt, but still somewhat recognizable. These images may appear invalid to the identify tool. It is therefore recommended that images only be moved, not deleted, so that invalid images can be later reviewed by hand.

When calling ImageMagick’s identify tool for a given file, a successful exit code will be returned if the image can be read. ...