Data Recovery and Disk Utilities Forum @R-TT

How would R-Studio know if the 2nd instance is part of the file or the start of a new file, due to fragmentation or because of a false positive of the first instance?

Thanks for the tip. But is it not possible to count how many instances for the end of the file are found and set the end of reading the file when XXX instances are found? Or if that instance is not found for XXX bytes?

This is a common problem for Known File Types. Right now the way out is only one: recover the first part of the file, then the rest of the pieces which have only the end signature and "glue" them manually.

I need to create a custom know file type.
I readed all instruction on https://www.r-studio.com/creating-custom-file-type-r-studio.html#:~:text=Scanning%20for%20known%20file%20types,been%20partially%20or%20completely%20damaged .

common Begin of file is : \x09\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x6D\x64\x35\x00\x00\x00
common End of file is : \x69\x62\x53\x75\x6D\x6D\x61\x72\x79\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

XML generated by r-studio is :

<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="2.0">
<FileType id="50001" group="Archive" description="Veeam Backup" features="" extension="vbk">
<Begin combine="OR">
<Signature>\x09\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x6D\x64\x35\x00\x00\x00</Signature>
</Begin>
<End combine="OR">
<Signature offset="20">\x69\x62\x53\x75\x6D\x6D\x61\x72\x79\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00</Signature>
</End>
</FileType>
</FileTypeList>

The problem is that the common End signature is on the middle of file too, and R-Studio break recovery when see it and do not go until the real end of file.

How i can tell to r-studio to go until the last common End signature ?