cgsecurity.org

Hi,

I'm trying to recover some of my wife's school files off her usb stick and I'm having trouble with creating a custom signature. The file is a .cxm and from the hex editor the first line is this:

------------------------------------------CPS EXPORT SECTION type=1 name=Mac

so for the photorec.sig file i was using this:

cxm 0 "------------------------------------------CPS"

when i run fidentity it comes up as a text file:

Documents/database.cxm: txt

and I'm not sure what im doing wrong, any ideas are greatly appreciated. Thanks!

You would be better of using the string "CPS EXPORT SECTION" as your signature. Count the number of "-" characters before the string and use the start of the string as your file offset, so if there were 20 "-" characters before "CPS EXPORT SECTION", your custom signature would be:

cxm 19 "CPS EXPORT SECTION"

That should work, assuming there are consistently 20 hyphen characters at the start of the cxm file.

thanks i'll give it a shot