Page 1 of 1

Can't parse signature with fidentify_win.exe

Posted: 08 May 2014, 15:57
by Frogdaddy
If I move the beginning hex to the end the next in a series gets the same error. Are there limits to the number of customized sigs in the photorec.sig? I've saved in notepad as ANSI and checked in hex editor it doesn't begin with any UTF hex codes. Do I have the formatting wrong?

Open signature file C:\Documents and Settings\Owner\photorec.sig
Can't parse signature: 4B 03 04 14 00 06 00
63 6F 6E 65 63 74 69 78
FF D8 FF E0 xx xx 4A 46 49 46 00
FF D8 FF E1 xx xx 45 78 69 66 00
FF D8 FF E8 xx xx 53 50 49 46 46 00
FF F1
FF F9
00 00 00 20 66 74 79 70 4D 34 41 20
624 first-level signatures enabled

Re: Can't parse signature with fidentify_win.exe

Posted: 08 May 2014, 17:49
by Frogdaddy
I figured it out. Searched previous posts for some ideas and found my hex signature format was not correct. Hence, parse error. This site was a help as it relates to the hex values for the file types needed and their extensions.

http://www.garykessler.net/library/file_sigs.html


fidentify.log looks better:

pen signature file C:\Documents and Settings\Owner\photorec.sig
register a signature for docx
register a signature for pptx
register a signature for xlsx
register a signature for vhd
register a signature for jpg
register a signature for jpg
register a signature for jpg
register a signature for m4a
register a signature for aac
register a signature for aac
634 first-level signatures enabled


Thanks.

Re: Can't parse signature with fidentify_win.exe

Posted: 09 May 2014, 06:53
by cgrenier
All the signatures you list are already known by fidentify/PhotoRec