Question about custom file type OR and AND
Question about custom file type OR and AND
Can I add multiple possible signatures for one file type? Does OR mean try signature1, try signature2 etc.?
Is this correct, will either of these signatures detect the file:
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
Is this correct, will either of these signatures detect the file:
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
You do not have the required permissions to view the files attached to this post.
Re: Question about custom file type OR and AND
I was under the impression this forum was monitored by R-TT support..
Re: Question about custom file type OR and AND
Yes.
OR means that if any of the signatures is found, the file will be identified as the file type.
AND means that all of the signatures must be found to identify the file as the file type.
One file is not enough to test its signature. To test a signature against its file type the following steps should be taken:
1. A flash drive should be full-formatted, that is, filled with zeros.
2. At least three files of the tested type should be written to the drive, those files should be separated by zeros.
3. The drive should be scanned, all file system should be disabled and only the tested file type should be enabled.
4. Both the beginning and end of the files should be identified correctly.
Re: Question about custom file type OR and AND
Thank you! So my file would work, if any of the signatures is detected it should 'fire', right?
Re: Question about custom file type OR and AND
Thank you for a very useful posting!DiskTuna wrote: ↑Sat May 08, 2021 7:35 amRAW wallet.dat recovery using R-Studio.
https://www.disktuna.com/recover-lost-o ... -r-studio/