Photorec.sig creating

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Mtrix
Posts: 1
Joined: 11 Feb 2013, 15:04

Photorec.sig creating

#1 Post by Mtrix »

Hi,

I have a problem with creating Photorec.sig file. I always get a very long hex string for each sample file. Can anyone help?

There are my sample files:
https://dl.dropbox.com/u/17989888/Sample.zip

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec.sig creating

#2 Post by cgrenier »

The first step when creating signature is using fidentify to check if the signature is already known.
- The DNZ file is recovered as a .zip.
- iam, idt,ipt and idw are recovered as .doc

Here are signatures for acm and ipj files:
acm 0 "PAMA" 0x00 0x03 0x00 0x00
ipj 0 0xff 0xfe 0x3c 0x00 0x3f 0x00 0x78 0x00

For .rbr, I have found any constant that I can use as signature.
For .t, you have only provided a single file. You need several to create a signature.

Locked