Page 1 of 1
Setup a signature for a *.cs file
Posted: 15 May 2012, 14:02
by jchannon
A *.cs file is a code file for C# a Microsoft development language.
I followed the instructions on the Wiki
http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec but I could not get fidentity to work.
Can someone help?
I created a file called photorec.cs and the contents are cs 0 "Visual C# Source file (.cs)"
Re: Setup a signature for a *.cs file
Posted: 15 May 2012, 14:51
by jchannon
*BUMP*
Anybody? I'm really struggling
Re: Setup a signature for a *.cs file
Posted: 15 May 2012, 15:45
by jchannon
OK I think I have it working.
My sig file looks like this
However when I check with fidentity it returns ?cs instead of cs
I ran PhotoRec but its so far returned 3500 files.
Is there any way I can narrow it down any more?
Re: Setup a signature for a *.cs file
Posted: 15 May 2012, 16:19
by Fiona
If you still exerience any problems send a file pattern to Christophe Grenier;
http://www.cgsecurity.org/wiki/PhotoRec#Problems_.3F
Fiona
Re: Setup a signature for a *.cs file
Posted: 15 May 2012, 16:24
by jchannon
I'll ask him about the question mark but I was hoping of a way to restrict the searching more as it takes 1hr 30mins to do the search and returns over 4500 files. I only need about 50 files that were deleted.
Re: Setup a signature for a *.cs file
Posted: 16 Jun 2012, 09:58
by SailorCM
forget 0xEF 0xBB 0xBF .. it's just the signature for UTF-8 encoded files...
what you need is:
Code: Select all
cs 0 0xefbbbf6e616d657370616365
cs 0 0x6e616d65737061636520
cs 0 0x7573696e6720
cs 0 0xefbbbf7573696e6720
sln 0 0xefbbbf0d0a4d6963726f736f66742056
userprefs 0 0xefbbbf3c50726f706572746965733e0a
and human readable:
Code: Select all
cs 0 ...namespace
cs 0 namespace
cs 0 using
cs 0 ...using
sln 0 .....Microsoft V
userprefs 0 ...<Properties>.
... are unprintable chars - mostly UTF8-BOM - that's so far.. maybe we could collect some signatures for source-files here to restore more visual-studio related files
Re: Setup a signature for a *.cs file
Posted: 16 Jun 2012, 15:06
by cgrenier
When you create your signature file, be carefull that it doesn't itself begin by an UTF-8 or UTF-16 BOM. I have added this warning on the wiki.