https://www37.zippyshare.com/v/6OjxtIPc/file.html (ones that I made)
Corruption on production files too high to include such files.
I've got some really good feedback for you, most of that I will share in a separate thread. You can improve your documentation and software with the upcoming feedback. But in relation to signatures, let me just comment on that. First of all, the software should indicate that the user signature will has been loaded. I ran your suite on linux, put the signature file in the home directory, but had no indication that it was loaded or working. If it tells me it is loaded, and it is not detecting my signatures, then that indicates a coding issue. But if I don't know that file is even loaded, I cannot figure out what's wrong.
You signature example in your documentation is too simple; I had to think which I was fun but something obviously didn't pan out as it did not detect the files.
Now this will come perhaps a bit as a shock. But hex editors on mac present data differently than they do on windows. On windows, a byte is broken it 4 pieces, and so you have 2 digit groupings. On mac, a byte is not broken up. The confusion is, and to represent a byte, is suppose you have 0x00000100, this is one byte. If I express that in a signature, does the software expect or can I simplify as 0x100? Also, ascii and sort of a lack of standardization make it so that values under the letter A or 38 in the ascii table; it is not clear what is the character representation and by that I mean there are difference between mac and windows. For example, 00 is a dot on windows, but may be a space on mac. For example, 0x40420f0035, on a mac this is @B 5 Three spaces between B and 5. But as I have said on windows 00 is a dot. Also your documentation over simplified signature example doesn't explain how to input multiple signatures for a single extension. The first signature I tried was:
bm2 8 0x00000100c0300000c0300000c0300000
and this photorec.sig was place in the home directory and I ran it for a bit (not all the way) and it didn't detect any.
I then tried the following photorec.sig
bm2 12 "¿...¿...¿" (this is suppose to approximate the above starting from c0300000) Though maybe the software was picky, and this was more accepting.
bm2 36 0x40420f0035
bm2 51 0x40420f0035
Interestingly, the reason for the difference in the last two signatures has to do with whether a background was used. Poor programming on their part, I say.
I did a full scan with that signature and did not detect any file.
Now I have a correction to make with regard to EaseUs which I will go into more detail later.
Easeus detected 42199 files, photorec detected around 25,000 can't remember exact number. I know the reason for this.
The fact that Easeus keeps corrupted files could easily explain the discrepancy, but I know there is more to it.
I will also perform my scan on linux again, but this time with keep corrupted files.
Another possible improvement would be to create a log file, exact appearance as terminal stats, for all corrupted file types.
That way it communicates with the user, "Ya, I found them, but unfortunately they were not recoverable."
You could then have an option in the program, "only scan this sector to this sector, try to recover files, max time allowed 60 min", by the end of, and this case one 1 hour, only the best least corrupted files should remain, the user can then test or examine these files to see if there is any use in keeping them. Stay tuned, I've got a lot more feedback coming your way.
I should add, there should be an option for yet another separate log to log sector ranges for a given extension, in my case, bm2.