Photorec not finding the Signature
Posted: 09 Dec 2015, 03:34
I have been trying to use photo rec to recover my .nwdb files that got deleted. I hexedit the file and copied the header info and entered it into a signature file and placed it in my users folder. I use fidentify_win and use a test file and it says "test.nwdb: nwdb" which means it should be correct. I have placed a few files on another hard drive and used photorec to scan for them and it finds 0 files??? What am I doing wrong? The signature i am using goes
nwdb 0 0xBF165BC500000000..... Is that correct??
This may be possibly useless code..
nwdb 0 0xBF165BC500000000..... Is that correct??
Code: Select all
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 BF 16 5B C5 00 00 00 00 0A 00 00 00 00 00 00 00 ¿ [Å
00000010 9D 7B 35 00 01 00 00 00 28 00 00 00 00 00 00 00 {5 (
00000020 01 00 00 00 00 00 00 00 09 04 00 00 06 00 00 00
00000030 03 00 05 00 90 1F 00 00 00 00 00 00 00 00 00 00
00000040 0F 00 00 00 4A 02 00 00 06 00 05 1E 00 00 00 00 J
This may be possibly useless code..
Code: Select all
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
000046D0 00 00 00 00 00 00 00 00 00 00 03 00 00 00 FF FF ÿÿ
000046E0 FF FF FF FF FF FF 00 80 07 80 23 00 23 00 23 00 ÿÿÿÿÿÿ € €# # #
000046F0 23 00 23 00 23 00 23 00 23 80 49 6D 61 67 65 73 # # # # #€Images
00004700 00 44 46 5F 49 6D 61 67 65 73 5F 55 73 65 42 69 DF_Images_UseBi
00004710 6E 61 72 69 7A 65 64 49 6D 61 67 65 00 55 73 65 narizedImage Use
00004720 42 69 6E 61 72 69 7A 65 64 49 6D 61 67 65 00 00 BinarizedImage
00004730 00 00 00 26 00 00 00 80 1F 40 FF FF 38 00 04 00 & € @ÿÿ8
00004740 00 00 00 00 00 00 00 24 07 00 40 00 08 00 00 00 $ @
00004750 00 00 00 00 00 00 00 00 00 00 00 00 0D 00 08 00