Sign up with GoogleHey,
I have an iPad that has had a photo deleted that I need to recover.
I found out there are thumbnail files on the iPad, each file containing hundreds of photos at a specific resolution and an unknown format. In the past, there seems to have been people who have cracked this format, however it looks like Apple changed the format slightly around 2 years ago. So far no tools I have found has been able to successfully recover these images (including forensics software). If we find a way to read these ithmb files, we could recover most deleted photos of any iOS device (although at a lower resolution.)
Some links to earlier times this has been cracked:
github.com
github.com
Attached is 3 of these files and 3 images that I know are in those thumbnail files taken off a test iPod touch that had only had 4 photos taken in total.
After going through the raw binary and writing some test programs, I have learned the following:
1. The pictures are separated by a byte sequence that looks like:
2. If you split each image into 16-byte segments, and use the 6th index byte for the R,G,B value in a new image, you get a slightly messed up grayscale version of the image:
Here is some of the hex bytes from the start of 3307.ithmb attached:
I have attached the code I have been using so far. Feel free to rename the attached .ithmb.txt files to .ithmb and try to crack them.
Can anyone spot what this format is? Have any suggestions or ways to read these files?
I have an iPad that has had a photo deleted that I need to recover.
I found out there are thumbnail files on the iPad, each file containing hundreds of photos at a specific resolution and an unknown format. In the past, there seems to have been people who have cracked this format, however it looks like Apple changed the format slightly around 2 years ago. So far no tools I have found has been able to successfully recover these images (including forensics software). If we find a way to read these ithmb files, we could recover most deleted photos of any iOS device (although at a lower resolution.)
Some links to earlier times this has been cracked:
GitHub - kebwi/Keiths_iPod_Photo_Reader: Keith's iPod Photo Reader decodes images from the .ithmb file format used by Apple iPods
Keith's iPod Photo Reader decodes images from the .ithmb file format used by Apple iPods - kebwi/Keiths_iPod_Photo_Reader
github.com
GitHub - cyianor/ithmbrdr: Reader for iPod ithmb files
Reader for iPod ithmb files. Contribute to cyianor/ithmbrdr development by creating an account on GitHub.
github.com
Attached is 3 of these files and 3 images that I know are in those thumbnail files taken off a test iPod touch that had only had 4 photos taken in total.
After going through the raw binary and writing some test programs, I have learned the following:
1. The pictures are separated by a byte sequence that looks like:
Code:
0x 20 00 00 00 20 00 00 00 00 00 00 00
^ Width ^ Height
Width and height are both 32 in this example2. If you split each image into 16-byte segments, and use the 6th index byte for the R,G,B value in a new image, you get a slightly messed up grayscale version of the image:
Here is some of the hex bytes from the start of 3307.ithmb attached:
I have attached the code I have been using so far. Feel free to rename the attached .ithmb.txt files to .ithmb and try to crack them.
Can anyone spot what this format is? Have any suggestions or ways to read these files?
