*.dad files

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

*.dad files

#1 Post by jayj »

Hi there,
After 2 weeks of trying to recover a lost partition on my DVR, I finally came to point where I figured out where my lost data is on the lost drive.
A 500gb DVR hdd failed when I connected it through a USB docking station to win 7. Apparently the fie system was linux and it failed.
Anyway the drive is 500gb and using testdisk and photorec I recovered 400gb of data as mpg files and none of it was my data, these were just old data from the previous dvr this hdd was mounted on)
I am assuming my data to be *.dad files
I also know that my data is from 776000000 - 976000000 sectors of the drive
My problems:
1. I need custom extension *.dad to be recovered. I do not understand how to form that signature for photorec to recover these
2. I want to search only a certain part of the hdd, above sectors
3. I am trying through windows and unfortunately when I go through different steps listed all over the internet, fidentify_win gives an error saying " fidentify cygwin warning:
MS-DOS style path detected: C:\Users\Master Is\photorec.sig
Preferred POSIX equivalent is: /cygdrive/c/Users/Master Is/photorec.sig
CYGWIN environment variable option "nodosfilewarning" turns off this warning."
I have a folder named testdisk on my desktop which includes photorec and testdik and fidentify_win etc. I just double click to open fidentify and it gives an error.

Where should I write that path??
Thanks

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.dad files

#2 Post by cgrenier »

You can ignore the warning.
Concerning the .dad files, please provides file samples or some hex dump of the beginning of a few files

jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

Re: *.dad files

#3 Post by jayj »

I added hex view of 2 files
Attachments
dad2.png
dad2.png (12.07 KiB) Viewed 5782 times
dad.png
dad.png (18.16 KiB) Viewed 5782 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.dad files

#4 Post by cgrenier »

Create a photorec.sig file with

Code: Select all

dad 0 "DHAV"

jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

Re: *.dad files

#5 Post by jayj »

thank you
can you also tell me where to put this photoreg.sig? any specific folder?
also is there a way to search a specific sector of the hard drive instead of all of it?

jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

Re: *.dad files

#6 Post by jayj »

ok great finally after 3 weeks I began recovering data :)
thank you!!!

but there is a problem. This data is dvr recording of security cams. There were 4 cameras.
Normally for each cam there is a different *.dad file.
However only in the first 15 minutes I recovered 11.000 small files. It finds too many files, they should be bigger files normally.
At the beginning of the scan I chose expert mode and when it asked me the sector size I chose the default value of 512.
Can that be the problem? If I choose a bigger size can I get bigger files??
thank you again

jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

Re: *.dad files

#7 Post by jayj »

yes big problems here.
17.000 small files recovered
and they are mixed
meaning cam1 and cam2 are in the same small file

do you think we could recover different file sizes by changing the custom signature?
I don't know much about programming but is this signature saying "recover all the files that start with dhav on 0 buffer"
is there any way of adding different characteristics to that sig?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.dad files

#8 Post by cgrenier »

Can you upload some original dad files ? What is the name/brand of the recording device ?
I will see if it's possible to do.

jayj
Posts: 12
Joined: 30 Apr 2014, 17:25

Re: *.dad files

#9 Post by jayj »

the min file size I found is 25Mb
I could send via wetransfer.com if you give me an address

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: *.dad files

#10 Post by cgrenier »


Locked