I want to know how I can search for a specific file type: I have entered a SSH server and I am trying to search for a .jpg file, but the owner of the server (my teacher) has removed all extensions.

I have tried grep -lr "JFIF" and I have found many directories with the same file name, so I jumped into a random directory which was found with the grep command and I tried to use the cat command on it, but the terminal couldn't show the entire binary.

Also the strings command is blocked on the ssh server, my teacher said that you have to find a jpg file and that this file contains a serial number (SN), but I have no idea where to find it.

If you guys want the SSH cardinals I will be happy to give them out to you, anyway my teacher said that you can use the file command to do that but I don't know how to do it.

BTW : he said (SN)

  • 3
    So you want help with homework? Feb 11, 2016 at 16:48
  • yes please help me if you can :)
    – adib
    Feb 11, 2016 at 16:49
  • 2
    Check out the manual for file: man file. Feb 11, 2016 at 16:52
  • 2
    We're not a free homework service, you know . . . But you did show some effort , which is good . . . Feb 11, 2016 at 16:52
  • i am sorry, but i have tried what i know but no thing has happened, if you can help me or at least give some advice or hint i would appreciate it
    – adib
    Feb 11, 2016 at 16:56

4 Answers 4


I'll try to give you some hints so you can solve your HW yourself.

Follow this steps:

  1. read the manual of file by executing man file.
  2. Then try it out by file somefile and see what happens
  3. Try to run file on different file types
  4. By now you should be able to understand how to find out if some file is a jpeg image or not.
  5. now read the manual for find (or use google to find out how to use it to find all files in some directory and all subdirectories)
  6. now find out how to use -exec option of find in order to connect it with previously used file command
  7. Now you should be able to find out the filetypes of all files in needed directory and list them
  8. Now read about pipes | and grep command to find out how to filter only for JPEG files.
  • 1
    Very good answer, teach the man to fish, without giving the fish. Upgoated. Keep doing the good job ! Feb 11, 2016 at 18:16
  • thank so much for your simplification, right now my only problem is to know to use -exec option of find to connect it with file command
    – adib
    Feb 11, 2016 at 19:08
  • @adib reading this should help you. Feb 11, 2016 at 19:12
  • @incBrain i have ran a code which looks like this find / -exec file {} \; | grep "SN" , but it ran across all files i think
    – adib
    Feb 12, 2016 at 7:07
  • 2
    I posted it as an answer, thank you so much for your instructions :) @incBrain
    – adib
    Feb 13, 2016 at 13:21

First of all i want to thank @incBrain and @Serg for not answering my question directly which helped me understand a lot of new things :).

My task was finding a specific .jpg file that has it's extension removed, the first thing I though of is .jpg magic byte which was JFIF, and with @incBrain Instructions I was able to build this command

find / -exec file {} \; | grep "JFIF"

that line links the find command to file command using -exec then gets the output of both find & file commands and transfer it as an input through the pipe symbol | for the grep command which shows only the files that contain JFIF in their binary a.k.a .jpg files .

My problem actually was finding a specific serial number, at first I though that the serial number is included in the file's binary but that was wrong, then a crazy though came to my mind

Oh! why don't I see what the picture looks like, I mean if I can't find the serial number, getting the picture would be a good thing

and I have searched the Internet for a good way to transfer files from SSH into my machine and I've found this block of code which worked out!

scp [email protected]:/home/example/file.txt /Local_Directory

I hope that this answer helps someone in the future :).


One possible solution could be this: use find which recursively lists regular files (-type f), and performs file command upon each one of them. Redirect output to grep to filter out filetypes.

However here, I would like to do something more fun than that; more awkward , but more fun.

$ find .  -maxdepth 1 -type f -printf "%f\t" -exec hexdump -n8 {} \;  | awk '/d8ff e0ff 1000 464a/{print $1}'

As you may or may not know every file has first 8 bytes of any file designate the filetype. Thus using find we search for all regular files, print it's name, but then execute hexdump to extract first 8 bytes, and let awk filter out only those filenames that have those first 8 bytes.

Here's a small proof:

$ hexdump -n 10 1450763029649.jpg               
0000000 d8ff e0ff 1000 464a 4649               

$ hexdump  -C -n 10 1450763029649.jpg           
00000000  ff d8 ff e0 00 10 4a 46  49 46                    |......JFIF|
  • Nice stuff by using hexdump +1. However I'm not sure about first 8 bytes. I did take a look into JPEG standard (Annex B) and it tells that the first 2 Bytes are StartOfImage (SOI 0xFFD8) and then there are 2 Bytes frame header and 2 Bytes frame size following by the frame payload. The frame header 0xFFE0 belongs to Application data and in your case the 2 byte length of app data are 0x0010 = 16 Bytes Feb 11, 2016 at 20:59
  • okay so for JFIF we can be sure that after SOI there will be JFIF-APP0 and the first 8 bytes of this segment (or first 10 of the file) will 100% contain JFIF string. I experimented with moving this APP segment to different location within the file and indeed file still recognised it as JPEG but not as JFIF Feb 11, 2016 at 21:34
  • @incBrain Well, remember that file command works pretty much the same way - it checks first several bytes. But at the same time, when you replace APP part you are probably shifting bit sequences, so what once may have been 1010 in binary , now becomes 0101 for the sake of example. Does that image still open ? Feb 11, 2016 at 22:23
  • Also , I've noticed something very interesting my CPU is little endian, so the way it reports data is low byte first. So yeah, first four bytes are 0xFFD8E0, but look at how hexdump reports it : d8 ff e0 d8 Feb 11, 2016 at 22:27
  • So point is, that image may be damaged, but we still can know that's an image just from the first two bytes, remembering the way that data is processed also Feb 11, 2016 at 22:43
file * | grep -i "jpeg"

This will search through every file in the directory and return it's file type. Via the Pipe | these results then get searched through by grep to find the file with the file type of "jpeg" or basically a .jpg file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .