Photorec custom file format (*.abc) but using no signature

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
PeterB
Posts: 2
Joined: 07 Mar 2013, 04:25

Photorec custom file format (*.abc) but using no signature

#1 Post by PeterB »

Hi there,

How do I use (Photorec ?) to recover all files with a specific custom extension (e.g. *.abc) but without specifying a particular signature? This file does not have a constant signature anywhere in its contents.

I have followed the instructions here

http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec

And using a null string at offset zero, but understandably that doesn't work.

regards
Peter

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec custom file format (*.abc) but using no signatu

#2 Post by cgrenier »

If there is no constant specific to the file type, the data need at least to have some properties that can be use to identify the file. In this case, a programmer can add the necessary code to PhotoRec.

PeterB
Posts: 2
Joined: 07 Mar 2013, 04:25

Re: Photorec custom file format (*.abc) but using no signatu

#3 Post by PeterB »

The files are binary and encrypted so unfortunately the only common property is its extension. Is that at all possible to cater for by writing specific source code for PhotoRec ?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec custom file format (*.abc) but using no signatu

#4 Post by cgrenier »

The only possibility will be to add some code to test the decryption of each data block and if it works, consider it's the beginning of a new file.

Locked