# Image extraction

**URL:** <https://sleuthkit.discourse.group/t/image-extraction/2197>\
**Category:** Autopsy Help\
**Created:** [October 4, 2020, 3:32pm UTC](https://sleuthkit.discourse.group/t/image-extraction/2197 "2020-10-04T15:32:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eddyn](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Eddyn](https://sleuthkit.discourse.group/u/Eddyn)\
**Post date:** [October 4, 2020, 3:32pm UTC](https://sleuthkit.discourse.group/t/image-extraction/2197/1 "2020-10-04T15:32:19Z")

</div>

Hey i’m looking for 2 modules that i can’t seem to find. First one is something that can extract embeded files in an already known file (Multiple JPG’s in the same jpg file) I have a case here that there are a multiple images that are 5+ times the size they should be so i’d like photorec carver or embedded file extractor but for known files not just unallocated. Finally an image/video repair module that uses already found headers and attempts to repair corrupted files using them (I know this one is a long shot and pretty complex). Thanks

---

<div class="post-metadata">

**Author:** ![Alan\_Browne](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/alan_browne/32/960_2.png) [@Alan\_Browne](https://sleuthkit.discourse.group/u/Alan_Browne)\
**Post date:** [October 6, 2020, 5:00pm UTC](https://sleuthkit.discourse.group/t/image-extraction/2197/2 "2020-10-06T17:00:13Z")

</div>

Hi Eddyn

I wrote a python module that carves jpgs, pngs, bmps and gifs that are embedded in files such as sqlite databases, docs and data stream files by default. But if you run it on all files rather than on the default settings then it should be able to extract jpgs that are embedded in another jpg file. It uses foremost carving tool and carves based on file headers and footers. Hope it will help.

The module can be found on GitHub

> **[TABrowne/Autopsy-filecarver](https://github.com/TABrowne/Autopsy-filecarver)**
>
> Python Module for Autopsy that carves files and slack space for embedded jpgs, bmps, pngs and gifs and adds them as derived files of the parent file - TABrowne/Autopsy-filecarver

---

<div class="post-metadata">

**Author:** ![Eddyn](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Eddyn](https://sleuthkit.discourse.group/u/Eddyn)\
**Post date:** [October 6, 2020, 5:56pm UTC](https://sleuthkit.discourse.group/t/image-extraction/2197/3 "2020-10-06T17:56:56Z")

</div>

That’s great thanks alot i’ll give it a try now 🙂

---

<div class="post-metadata">

**Author:** ![Eddyn](https://avatars.discourse-cdn.com/v4/letter/e/6de8d8/32.png) [@Eddyn](https://sleuthkit.discourse.group/u/Eddyn)\
**Post date:** [October 6, 2020, 6:20pm UTC](https://sleuthkit.discourse.group/t/image-extraction/2197/4 "2020-10-06T18:20:56Z")

</div>

Sorry just one question, where do the files go (i’m pretty new to autopsy). The carved folder is already at 700k files so it’s all abit of a mess atm. EDIT: Never mind i just restarted it and i see now thanks
