Within the AOL 2.5 system data, are well over 100 embedded *.gif images inside of system files.
I set out to attempt to extract out all of the files so that I could locate the original AOL sign-on dramatic lightning bolt, starry night sky and golden key which was deprecated with the release of AOL 3.0 and above. Since we can no longer sign-on to the AOL service, there is no simple and direct way to display these images and see them again since they are embedded somewhere in the system files on the floppy disk.
I set out by manually carving out each GIF image I could find, starting with \AOLDIAG\AOLDIAG.DLL. Inside that file are three GIF files; here’s an example of one that I carved out:
Good lookin’ modem. Manually carving files is a slow process. One advantage is that by going through the hex, you can be absolutely certain that you’ve analyzed the data to the extent it can be analyzed.
However, as I progressed, I saw that there were just too many embedded GIFs and it was going to take an incredibly long time to manually carve them all. So, as a solution, I set out to use the command-line tool Foremost in a Linux Virtual Machine to attempt to carve them out manually. By default, Foremost doesn’t recursively scan subfolders — so, my first pass failed to find the Golden Key. I then combined the find command and piped it into the foremost command so that it would recursively search all files, as follows:
find . -type f -print0 | xargs -0 foremost -t gif -o ~/Desktop/extracted_gifs -i
If you use the above command, make sure that you’re first inside of the folder you wish to carve. The period immediately after the find command signifies the current directory. -type f: Tells find to only look for files and not directories. -print0 prints the filenames separated by null characters so that in case a space is in a filename (which it won’t be with old software like AOL 2.5, but this is good practices) it won’t make a new lines/enter. The pipe (|) takes the output of the find command and sends it as input to the next command.
xargs -0 takes the null-separated filenames from find and passes them as “arguments” to foremost. The -0 tells xargs to expect null-separated input. -t gif just means setting the type to GIF and the -o flag is merely the output directory. The -i at the end is for input which we’re getting from the find command. Quite the workaround for the lack of subfolder recursion built-in to Foremost.
Another workaround could be just to zip up the contents of all folders and then unzip them setting flags to ignore folders/directory tree and then execute Foremost on the “flattened” directory.
AOL 2.5 – The Key and lightning dial-up connection screen; assembled and scaled up 300%.
The key and starry night sky images are located within the IDB/MAIN.IDX file at offsets: 445762, 447845, 450779, 453176, and 456257. The original size of each image is 110×77, incredibly small by today’s standards but when viewed on a CRT display at 640×480, I recall it looking quite large.
It certainly seems like a fair bit of work to reconstruct these images and one might wonder: why bother? Why not just find them online somewhere with Google Images? Well, turns out — you can’t. Try for yourself. These images are absolutely nowhere to be found except for right here; nobody else has bothered to dig them up and they were evidently lost to time, until now.
No Comments