File-ID / Customizing File Types

Post a reply


This question is a means of preventing automated form submissions by spambots.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:

BBCode is ON
[img] is ON
[url] is ON
Smilies are ON

Topic review
   

Expand view Topic review: File-ID / Customizing File Types

Re: File-ID / Customizing File Types

by Alt » Tue Oct 20, 2009 3:47 pm

I'd rather use this one (not tested!)
If your file signature for the end is 0x46 F 0x43 0x00 0x00 0x01 0x00 0x00 0x00
<?xml version="1.0" encoding="utf-8"?>
<FileTypeList>
<!-- Search for NTFS BTW -->
<FileType id="1234" group="Other files" description="BTW" features="TXT_ANSI TXT_UNICODE" extension="btw">
<Signature offset="0" from="begin" count="1">FILE</Signature>
<Signature offset="10" from="end" count="1">\x46F\x43C\x00\x00\x01\x00\x00\x00</Signature>
</FileType>
</FileTypeList>

And
<?xml version="1.0" encoding="utf-8"?>
<FileTypeList>
<!-- Search for NTFS BTW -->
<FileType id="1234" group="Other files" description="BTW" features="TXT_ANSI TXT_UNICODE" extension="btw">
<Signature offset="0" from="begin" count="1">FILE</Signature>
<Signature offset="8" from="end" count="1">\x46\x43\x00\x00\x01\x00\x00\x00</Signature>
</FileType>
</FileTypeList>

for 46 43 00 00 01 00 00 00

File-ID / Customizing File Types

by ShadowMozez » Mon Oct 19, 2009 6:17 pm

Hello.

I'm searching some files at a deleted HDD.

The file typ is *.btw
It's from the Application "Lexware"

The Signature is 46 43 00 00 01 00 00 00

Where can i find the File-ID?

I've made this *.xml for searching...
Is it correct and complete?


<?xml version="1.0" encoding="utf-8"?>
<FileTypeList>
<!-- Search for NTFS BTW -->
<FileType id="0" group="Other files" description="BTW" features="TXT_ANSI TXT_UNICODE" extension="btw">
<Signature offset="0" from="begin" count="1">FILE</Signature>
<Signature offset="0" from="end" count="1">\x46F\x43C\x00\x00\x01\x00\x00\x00</Signature>
</FileType>
</FileTypeList>


Thanx & sorry for my english :-\

ShadowMozez

Top