Acronis, user defined FileType

Post a reply


This question is a means of preventing automated form submissions by spambots.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:
BBCode is ON
[img] is ON
[url] is ON
Smilies are ON
Topic review
   

Expand view Topic review: Acronis, user defined FileType

Re: Acronis, user defined FileType

by Alt » Sun Sep 24, 2017 5:50 pm

And remember, Acronis files are huge and may be fragmented.

Re: Acronis, user defined FileType

by Data-Medics » Sun Sep 24, 2017 11:16 am

Also, if you're specifically trying to target these files, you'll probably want to disable all other file types when scanning. Because these files are large and likely to contain hundreds of other common file types inside them (albeit in a compressed state) it's likely to get some false positives from inside the image files which will make it carve out improperly.

So do your scan with only your custom XML enabled. You'll get better results.

Re: Acronis, user defined FileType

by Alt » Thu Sep 21, 2017 2:21 pm

This should work:

Code: Select all

<FileTypeList>
 <FileType id="50001" group="Acronis" description="Acronis TIB file" extension="tib">
   <Begin combine="and">
        <Signature>\xCE\x24\xB9\xA\x20\x00\x00\x00</Signature>
   <\Begin>
   <End combine="and">
        <Signature from="end" offset="7">\x00\x00\x00\x20\xA2\xB9\x24\xCE</Signature>
   </End>
 </FileType>
</FileTypeList>

Acronis, user defined FileType

by hanspet2 » Thu Sep 21, 2017 5:17 am

Hi,

i try to recover TIB-Files from Acronis 2017 and 2018. I have read many Acronisfiles from my Harddisk with WinHEX.

The Begin and the End of all my Acronis Files are the same.

Begin : (HEX) CE 24 B9 A2 20 00 00 00
End: (HEX) 00 00 00 20 A2 B9 24 CE

If i try to defined customer Filetype like : (Example from R-Studio)
<FileType id="50001" group="Multimedia Video" description="Sony cam video, XDCam-EX" extension="mp4">
<Signature>\x00\x00\x00\x18ftypmp42\x00\x00\x00\x00mp42\x00\x00\x00\x00\x00\x00\x00\x08free</Signature>
<Signature from="end" offset="21">\x3C\x2FNonRealTimeMeta\x3E\x0D\x0A\x00</Signature>
</FileType>
</FileTypeList>
it dont works.

Can somebody help me to make a working .xml File to import it in R-Studio ?
Or can somebody show me how a have to do it with the Data from my Files.

best regards

Top