cgsecurity.org

I'm trying to recover .pwk Password Keeper file. I ran a hexdump on a sample, which returns image visiable in the attachment.

What should be photorec file? Would following work? If yes, why do I ignore first line which has some strange

pwk 0 "Password Keeper"

The offset of this text is 16, not 0.
Create a photorec.sig file with .
If you need a better signature, please send me a zip archive with 3 pwk file samples of various size.

Thanks cgrenier, this worked and I was able to recover my file.