cgsecurity.org

cgrenier wrote:8k is 0x2000, so it looks like the first file is ok but too big.

Perhaps you meant to say "not big enough"? The restaured file is 8k when the original file to be restaured was 70k.

OK, so strangely, vbindiff crashes (core dumped) when I compare the first file (8Kb). It works correctly until I get to "0000 1FF0". No difference is visible between the two files up to that point. When I compare the second file (70Kb), there is a few differences between "0000 0000" and "0000 0060 ...

The file wasn't deleted and I choosed Whole.

I just tried with the suggested new signature (all other signatures disabled) and I get a similar result. Even though the filesystem is not corrupted / erased and the file on the partition isn't corrupted either, photorec restores two corrupted files. I can't dump anything from these files using ...

I just tried to see if photorec was able to recover Bitcoin-Qt wallets.

So I loop-mounted a small 100Mb block file, ext4 formatted it, and I copied a wallet file from Bitcoin-Qt 0.8.5 (70Kb) on it. I then umounted the loop file and used photorec to see if it could restore something from it.

With ...