cgsecurity.org

I've noticed some legit DRW files can have some differences after the 8th byte as well, for example:

00000000 01 ff 02 04 03 02 00 02 02 02 21 05 00
00000000 01 ff 02 04 03 02 00 02 00 02 21 05 00

I can't disclose the examples because one of them is private, the other one is from the BEISPIEL ...

great.

I've made it and created the pull request there: https://github.com/cgsecurity/testdisk/pull/100

About some samples, there are a few in this archive:
https://archive.org/download/micrografx_designer_31/designer.zip

in the BEISPIEL folder.

i've used them to make some hexdump and noticed ...

Hello,

I've made a new filter for the Micrographx Designer format. The extension is DRW (which is already used by another software)

I've identified the fingerprint of this format. It seems to be very simple. On 3 differents files, the hexadecimal dumps give in the header:

0000000 ff01 0402 0203 ...