Hello,
I am trying to add a custom signature to identify a 100GB+ image of file system. I tried to upload the image header (from a dd of first 256KB) and found that photorec doesnt recognize it.
https://www.cgsecurity.org/photorec/sca ... 9640d25c67
file command recognizes it as below
file up.raw
up.raw: Linux rev 1.0 ext4 filesystem data, UUID=88792c4f-4e67-4fb8-860d-3bb5b0f48049 (needs journal recovery) (extents) (large files) (huge files)
and also fidentify recognizes it which makes me wonder why photorec is not able to use that signature to identify the file ?
fidentify up.raw
up.raw: ext
How do I get this file recognized in the photorec ? Is there any tool where which I can get the signature from magic.mgc database to be used in photorec ?
Custom signature for an ext3/ext4 file system image
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Custom signature for an ext3/ext4 file system image
This "file" format is disabled by default.
Run PhotoRec, in FileOpts, disable all file formats, enable "ext" and start your recovery.
If the file was fragmented, the recovered file will be corrupted.
Run PhotoRec, in FileOpts, disable all file formats, enable "ext" and start your recovery.
If the file was fragmented, the recovered file will be corrupted.