Custom signature for an ext3/ext4 file system image

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
madguy24
Posts: 1
Joined: 22 Sep 2017, 18:43

Custom signature for an ext3/ext4 file system image

#1 Post by madguy24 »

Hello,

I am trying to add a custom signature to identify a 100GB+ image of file system. I tried to upload the image header (from a dd of first 256KB) and found that photorec doesnt recognize it.

https://www.cgsecurity.org/photorec/sca ... 9640d25c67

file command recognizes it as below

file up.raw
up.raw: Linux rev 1.0 ext4 filesystem data, UUID=88792c4f-4e67-4fb8-860d-3bb5b0f48049 (needs journal recovery) (extents) (large files) (huge files)

and also fidentify recognizes it which makes me wonder why photorec is not able to use that signature to identify the file ?

fidentify up.raw
up.raw: ext

How do I get this file recognized in the photorec ? Is there any tool where which I can get the signature from magic.mgc database to be used in photorec ?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Custom signature for an ext3/ext4 file system image

#2 Post by cgrenier »

This "file" format is disabled by default.
Run PhotoRec, in FileOpts, disable all file formats, enable "ext" and start your recovery.
If the file was fragmented, the recovered file will be corrupted.

Locked