Custom signature for an ext3/ext4 file system image
Posted: 22 Sep 2017, 18:50
Hello,
I am trying to add a custom signature to identify a 100GB+ image of file system. I tried to upload the image header (from a dd of first 256KB) and found that photorec doesnt recognize it.
https://www.cgsecurity.org/photorec/sca ... 9640d25c67
file command recognizes it as below
file up.raw
up.raw: Linux rev 1.0 ext4 filesystem data, UUID=88792c4f-4e67-4fb8-860d-3bb5b0f48049 (needs journal recovery) (extents) (large files) (huge files)
and also fidentify recognizes it which makes me wonder why photorec is not able to use that signature to identify the file ?
fidentify up.raw
up.raw: ext
How do I get this file recognized in the photorec ? Is there any tool where which I can get the signature from magic.mgc database to be used in photorec ?
I am trying to add a custom signature to identify a 100GB+ image of file system. I tried to upload the image header (from a dd of first 256KB) and found that photorec doesnt recognize it.
https://www.cgsecurity.org/photorec/sca ... 9640d25c67
file command recognizes it as below
file up.raw
up.raw: Linux rev 1.0 ext4 filesystem data, UUID=88792c4f-4e67-4fb8-860d-3bb5b0f48049 (needs journal recovery) (extents) (large files) (huge files)
and also fidentify recognizes it which makes me wonder why photorec is not able to use that signature to identify the file ?
fidentify up.raw
up.raw: ext
How do I get this file recognized in the photorec ? Is there any tool where which I can get the signature from magic.mgc database to be used in photorec ?