Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know how I can search for a specific file type: I have entered a SSH server and I am trying to search for a .jpg file, but the owner of the server (my teacher) has removed all extensions.

I have tried grep -lr "JFIF" and I have found many directories with the same file name, so I jumped into a random directory which was found with the grep command and I tried to use the cat command on it, but the terminal couldn't show the entire binary.

Also the strings command is blocked on the ssh server, my teacher said that you have to find a jpg file and that this file contains a serial number (SN), but I have no idea where to find it.

If you guys want the SSH cardinals I will be happy to give them out to you, anyway my teacher said that you can use the file command to do that but I don't know how to do it.

BTW : he said (SN)

share|improve this question
3  
So you want help with homework? – mikewhatever Feb 11 at 16:48
    
yes please help me if you can :) – adib Feb 11 at 16:49
2  
Check out the manual for file: man file. – mikewhatever Feb 11 at 16:52
2  
We're not a free homework service, you know . . . But you did show some effort , which is good . . . – Serg Feb 11 at 16:52
    
i am sorry, but i have tried what i know but no thing has happened, if you can help me or at least give some advice or hint i would appreciate it – adib Feb 11 at 16:56

I'll try to give you some hints so you can solve your HW yourself.

Follow this steps:

  1. read the manual of file by executing man file.
  2. Then try it out by file somefile and see what happens
  3. Try to run file on different file types
  4. By now you should be able to understand how to find out if some file is a jpeg image or not.
  5. now read the manual for find (or use google to find out how to use it to find all files in some directory and all subdirectories)
  6. now find out how to use -exec option of find in order to connect it with previously used file command
  7. Now you should be able to find out the filetypes of all files in needed directory and list them
  8. Now read about pipes | and grep command to find out how to filter only for JPEG files.
share|improve this answer
1  
Very good answer, teach the man to fish, without giving the fish. Upgoated. Keep doing the good job ! – Serg Feb 11 at 18:16
    
thank so much for your simplification, right now my only problem is to know to use -exec option of find to connect it with file command – adib Feb 11 at 19:08
    
@adib reading this should help you. – incBrain Feb 11 at 19:12
    
@incBrain i have ran a code which looks like this find / -exec file {} \; | grep "SN" , but it ran across all files i think – adib Feb 12 at 7:07
2  
I posted it as an answer, thank you so much for your instructions :) @incBrain – adib Feb 13 at 13:21
up vote 3 down vote accepted

First of all i want to thank @incBrain and @Serg for not answering my question directly which helped me understand a lot of new things :).

My task was finding a specific .jpg file that has it's extension removed, the first thing I though of is .jpg magic byte which was JFIF, and with @incBrain Instructions I was able to build this command

find / -exec file {} \; | grep "JFIF"

that line links the find command to file command using -exec then gets the output of both find & file commands and transfer it as an input through the pipe symbol | for the grep command which shows only the files that contain JFIF in their binary a.k.a .jpg files .

My problem actually was finding a specific serial number, at first I though that the serial number is included in the file's binary but that was wrong, then a crazy though came to my mind

Oh! why don't I see what the picture looks like, I mean if I can't find the serial number, getting the picture would be a good thing

and I have searched the Internet for a good way to transfer files from SSH into my machine and I've found this block of code which worked out!

scp user@example.com:/home/example/file.txt /Local_Directory

I hope that this answer helps someone in the future :).

share|improve this answer

One possible solution could be this: use find which recursively lists regular files (-type f), and performs file command upon each one of them. Redirect output to grep to filter out filetypes.

However here, I would like to do something more fun than that; more awkward , but more fun.

$ find .  -maxdepth 1 -type f -printf "%f\t" -exec hexdump -n8 {} \;  | awk '/d8ff e0ff 1000 464a/{print $1}'

As you may or may not know every file has first 8 bytes of any file designate the filetype. Thus using find we search for all regular files, print it's name, but then execute hexdump to extract first 8 bytes, and let awk filter out only those filenames that have those first 8 bytes.

Here's a small proof:

$ hexdump -n 10 1450763029649.jpg               
0000000 d8ff e0ff 1000 464a 4649               
000000a

$ hexdump  -C -n 10 1450763029649.jpg           
00000000  ff d8 ff e0 00 10 4a 46  49 46                    |......JFIF|
0000000a
share|improve this answer
    
Nice stuff by using hexdump +1. However I'm not sure about first 8 bytes. I did take a look into JPEG standard (Annex B) and it tells that the first 2 Bytes are StartOfImage (SOI 0xFFD8) and then there are 2 Bytes frame header and 2 Bytes frame size following by the frame payload. The frame header 0xFFE0 belongs to Application data and in your case the 2 byte length of app data are 0x0010 = 16 Bytes – incBrain Feb 11 at 20:59
    
okay so for JFIF we can be sure that after SOI there will be JFIF-APP0 and the first 8 bytes of this segment (or first 10 of the file) will 100% contain JFIF string. I experimented with moving this APP segment to different location within the file and indeed file still recognised it as JPEG but not as JFIF – incBrain Feb 11 at 21:34
    
@incBrain Well, remember that file command works pretty much the same way - it checks first several bytes. But at the same time, when you replace APP part you are probably shifting bit sequences, so what once may have been 1010 in binary , now becomes 0101 for the sake of example. Does that image still open ? – Serg Feb 11 at 22:23
    
Also , I've noticed something very interesting my CPU is little endian, so the way it reports data is low byte first. So yeah, first four bytes are 0xFFD8E0, but look at how hexdump reports it : d8 ff e0 d8 – Serg Feb 11 at 22:27
    
So point is, that image may be damaged, but we still can know that's an image just from the first two bytes, remembering the way that data is processed also – Serg Feb 11 at 22:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.