Can't parse signature with fidentify_win.exe

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Can't parse signature with fidentify_win.exe

#1 Post by Frogdaddy »

If I move the beginning hex to the end the next in a series gets the same error. Are there limits to the number of customized sigs in the photorec.sig? I've saved in notepad as ANSI and checked in hex editor it doesn't begin with any UTF hex codes. Do I have the formatting wrong?

Open signature file C:\Documents and Settings\Owner\photorec.sig
Can't parse signature: 4B 03 04 14 00 06 00
63 6F 6E 65 63 74 69 78
FF D8 FF E0 xx xx 4A 46 49 46 00
FF D8 FF E1 xx xx 45 78 69 66 00
FF D8 FF E8 xx xx 53 50 49 46 46 00
FF F1
FF F9
00 00 00 20 66 74 79 70 4D 34 41 20
624 first-level signatures enabled

Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Re: Can't parse signature with fidentify_win.exe

#2 Post by Frogdaddy »

I figured it out. Searched previous posts for some ideas and found my hex signature format was not correct. Hence, parse error. This site was a help as it relates to the hex values for the file types needed and their extensions.

http://www.garykessler.net/library/file_sigs.html


fidentify.log looks better:

pen signature file C:\Documents and Settings\Owner\photorec.sig
register a signature for docx
register a signature for pptx
register a signature for xlsx
register a signature for vhd
register a signature for jpg
register a signature for jpg
register a signature for jpg
register a signature for m4a
register a signature for aac
register a signature for aac
634 first-level signatures enabled


Thanks.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Can't parse signature with fidentify_win.exe

#3 Post by cgrenier »

All the signatures you list are already known by fidentify/PhotoRec

Locked