Photorec not finding the Signature

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
justcyber1
Posts: 1
Joined: 09 Dec 2015, 03:25

Photorec not finding the Signature

#1 Post by justcyber1 »

I have been trying to use photo rec to recover my .nwdb files that got deleted. I hexedit the file and copied the header info and entered it into a signature file and placed it in my users folder. I use fidentify_win and use a test file and it says "test.nwdb: nwdb" which means it should be correct. I have placed a few files on another hard drive and used photorec to scan for them and it finds 0 files??? What am I doing wrong? The signature i am using goes
nwdb 0 0xBF165BC500000000..... Is that correct??

Code: Select all

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   BF 16 5B C5 00 00 00 00  0A 00 00 00 00 00 00 00   ¿ [Å            
00000010   9D 7B 35 00 01 00 00 00  28 00 00 00 00 00 00 00    {5     (       
00000020   01 00 00 00 00 00 00 00  09 04 00 00 06 00 00 00                   
00000030   03 00 05 00 90 1F 00 00  00 00 00 00 00 00 00 00                   
00000040   0F 00 00 00 4A 02 00 00  06 00 05 1E 00 00 00 00       J



This may be possibly useless code..

Code: Select all

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000046D0   00 00 00 00 00 00 00 00  00 00 03 00 00 00 FF FF                 ÿÿ
000046E0   FF FF FF FF FF FF 00 80  07 80 23 00 23 00 23 00   ÿÿÿÿÿÿ € €# # # 
000046F0   23 00 23 00 23 00 23 00  23 80 49 6D 61 67 65 73   # # # # #€Images
00004700   00 44 46 5F 49 6D 61 67  65 73 5F 55 73 65 42 69    DF_Images_UseBi
00004710   6E 61 72 69 7A 65 64 49  6D 61 67 65 00 55 73 65   narizedImage Use
00004720   42 69 6E 61 72 69 7A 65  64 49 6D 61 67 65 00 00   BinarizedImage  
00004730   00 00 00 26 00 00 00 80  1F 40 FF FF 38 00 04 00      &   € @ÿÿ8   
00004740   00 00 00 00 00 00 00 24  07 00 40 00 08 00 00 00          $  @     
00004750   00 00 00 00 00 00 00 00  00 00 00 00 0D 00 08 00
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Photorec not finding the Signature

#2 Post by cgrenier »

Maybe the your signature isn't correct for other nwdb files
Have you try to recover your files using TestDisk, Advanced, Undelete ?
Top
Locked

Return to “File recovery”