cgsecurity.org

Hi all,

in ubuntu using photorec with custom file extension search option, in which folder the file should be saved .photorec.sig?

thanks for reply @recuperation,

12.2 File location
PhotoRec searches for the signature file named
• Windows: photorec.sig in the USERPROFILE or HOMEPATH directory, e.g. C:\Documents and
Settings\bob\ or C:\Users\bob.
• Linux and macOS: .photorec.sig in the HOME directory, e.g. /home/bob
• photorec.sig in the current directory
This file doesn’t exist by default, you need to create one. Using a text editor (e.g. notepad, vim. . . ), create the signature
file and add the signature you have identified.

I'm following the instructions in the guide, but I can't fix it.

in linux I put the file .photorec.sig in folder /home/ or in the folder /home/myname/

if this is the correct procedure, it means that the problem is another one.

salvo2020 wrote: 06 Sep 2023, 23:54 I'm following the instructions in the guide, but I can't fix it.

Which instructions exactly?
No documentation, no help!
Please be aware that I am lacking these foreseeing abilities, unfortunately.

recuperation wrote: 07 Sep 2023, 07:15

salvo2020 wrote: 06 Sep 2023, 23:54 I'm following the instructions in the guide, but I can't fix it.

Which instructions exactly?
No documentation, no help!
Please be aware that I am lacking these foreseeing abilities, unfortunately.

no ability to predict, I indicated the part of the guide you posted where it indicated the file location

put away:

salvo2020 wrote: 06 Sep 2023, 23:54 12.2 File location
PhotoRec searches for the signature file named
• Windows: photorec.sig in the USERPROFILE or HOMEPATH directory, e.g. C:\Documents and
Settings\bob\ or C:\Users\bob.
• Linux and macOS: .photorec.sig in the HOME directory, e.g. /home/bob
• photorec.sig in the current directory
This file doesn’t exist by default, you need to create one. Using a text editor (e.g. notepad, vim. . . ), create the signature
file and add the signature you have identified.

Thanks for your interest.
(Too bad it hasn't been resolved)

8.9.2023 9:53 CET recuperation: Merged this reposting in a new thread with the original one


considering what is explained in the guide posted below, how the signature file for this extension must be compiled:

00000000 67 69 6d 70 20 78 63 66 20 76 30 31 31 00 00 00 |gimp xcf v011...|
00000010 07 80 00 00 04 38 00 00 00 00 00 00 00 96 00 00 |.....8..........|
00000020 00 11 00 00 00 01 01 00 00 00 13 00 00 00 08 43 |...............C|

https://www.cgsecurity.org/testdisk.pdf

chapter 12.1 - page 46

Why are you posting your issue again in a second topic?!
I moved it to your original contribution.

How do you think your problems will be solved without ANY case documentation?

You were supposed to document what you did exactly and where you failed!
The absolute minimum I expected from you is to post the content of your individual sig-file, and not some hex file.

How should I else find out? Please tell me!
Is that so difficult?

Looking at your hex file I guess you are trying to find an xcf file:

https://www.cgsecurity.org/wiki/File_Fo ... y_PhotoRec

There is no reason writing an individual signature for a xcf file!

Hi @recuperation

recuperation wrote: 08 Sep 2023, 09:04 Why are you posting your issue again in a second topic?!
I moved it to your original contribution.

How do you think your problems will be solved without ANY case documentation?

Thanks for the reply, I'm new to the forum, even though the topics refer to the same problem I didn't want to add different references.

recuperation wrote: 08 Sep 2023, 09:04 Looking at your hex file I guess you are trying to find an xcf file:

https://www.cgsecurity.org/wiki/File_Fo ... y_PhotoRec

There is no reason writing an individual signature for a xcf file!

using Photorec 7.1 and selecting only the XCF extension the search finds nothing, and if I run the "fidentify test.xcf" command from the terminal I get the "unknown" file message.
so reading the guide I was trying to learn how to create a custom signature, but even following all the steps I can't find the right way.

recuperation wrote: 08 Sep 2023, 09:04 You were supposed to document what you did exactly and where you failed!
The absolute minimum I expected from you is to post the content of your individual sig-file, and not some hex file.

How should I else find out? Please tell me!
Is that so difficult?

xxd 'test.xcf' | head -n 3
00000000: 6769 6d70 2078 6366 2076 3031 3100 0000 gimp xcf v011...
00000010: 0780 0000 0438 0000 0000 0000 0096 0000 .....8..........
00000020: 0011 0000 0001 0100 0000 1300 0000 0843 ...............C

file .photorec.sig in folder '/home' and '/home/myname'
test 1: xcf 0 "gimp xcf v011"
test 2: xcf 0 "gimp xcf v011..."
test 3: xcf 0 "gimp xcf v011", 0x03, 0x03, 0x03
test 4: xcf 0 "gimp", 0x20, "xcf", 0x20, "v011", 0x03, 0x03, 0x03

trying the indicated procedure returns 0 files found.

so I hypothesized two possible problems:
1) the folder where I keep the .photorec.sig file is wrong
2) the contents of my .photorec.sig file are incorrect
or both things

I posted all the steps I took. would be happy that your interest, it would solve my problem.

What is your operating system under which you deleted or lost your xcf file?
Who is the maker of the disk in question? What is the name of the model?

Have you used the fidentify command on your signature file?

Here are some logical issues you should be aware of:

If you go to a restaurant and shout: "All vegan eaters rise your hand!" and there is nobody answering, do you expect the size of the result to be bigger if you shout "All vegan eater born in January rise your hand"?
A more specific search will never give more results than a less specific search.
The result of your second question has to be a subset <= the set of the answer to the first question. If the result of the first question is an empty set, do expect more outcome on the second one?

As test2 and test3 are more specific than test1 which gives no result, test2 and test3 need to fail as well, as there search ist just an extension of test1.

test2 is a proof that you ignored the written warning in the manual about dots.
The sequence "0x03, 0x03, 0x03" is nowhere to be found in your sample file header. Why did you put this in there?

mmmm

I'm sorry that you are not satisfied with what I reported, and I'm even more sorry that after what I published upon request (the entire process done by me) I found only some shortcomings, but no constructive discussion on how to create a custom signature. in the end the problem was specified, together with the parts where I encountered the problem, in your place I (if, and I underline "if"), knew the correct procedure to create a personalized signature, I would have explained the right procedure to you and in case show the various incorrect steps, without continuing to ask why so many things are done by those who don't know the right procedure. in fact I have emphasized several times to do "tests to understand" in the correct way. However, the story of the restaurant is nice, I would also agree with the reasoning itself, it's a shame that in this case a part was skipped, it would be the one where in the previous posts, I placed the parts where the guide explains what 0x20 and 0x03 are for and where it is reported in which folder the .photorec.sig file must be stored. so returning to your question, in test 1 I had read the three final points online that they were not necessary, in test 2 I instead tried with the complete signature, in test 3 I replaced the points with 0x03 as reported in the guide, and in the test 4 I replaced the spaces with 0x20 for the same reason as mentioned above. now in all these cases the result is always the same, i.e. no file found and just for completeness I'm trying with a file with the XCF extension made with Gimp used on Ubuntu and storing the file in a dedicated NTFS partition of about 3GB in order to speed up the search, so I copy the xcf file several times and delete it and then start the search with Photorec. I hope that after everything I have written, someone can tell me how to solve the problem. thanks.