Custom signature for an ext3/ext4 file system image

Using PhotoRec to recover lost data
Post Reply
Message
Author
madguy24
Posts: 1
Joined: 22 Sep 2017, 18:43

Custom signature for an ext3/ext4 file system image

#1 Post by madguy24 » 22 Sep 2017, 18:50

Hello,

I am trying to add a custom signature to identify a 100GB+ image of file system. I tried to upload the image header (from a dd of first 256KB) and found that photorec doesnt recognize it.

https://www.cgsecurity.org/photorec/sca ... 9640d25c67

file command recognizes it as below

file up.raw
up.raw: Linux rev 1.0 ext4 filesystem data, UUID=88792c4f-4e67-4fb8-860d-3bb5b0f48049 (needs journal recovery) (extents) (large files) (huge files)

and also fidentify recognizes it which makes me wonder why photorec is not able to use that signature to identify the file ?

fidentify up.raw
up.raw: ext

How do I get this file recognized in the photorec ? Is there any tool where which I can get the signature from magic.mgc database to be used in photorec ?

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3814
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Custom signature for an ext3/ext4 file system image

#2 Post by cgrenier » 24 Sep 2017, 09:25

This "file" format is disabled by default.
Run PhotoRec, in FileOpts, disable all file formats, enable "ext" and start your recovery.
If the file was fragmented, the recovered file will be corrupted.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests