Question about custom file type OR and AND

A forum on data recovery using the professional data recovery software R-STUDIO.
DiskTuna
Posts: 7
Joined: Mon Oct 12, 2020 11:21 am

Question about custom file type OR and AND

Post by DiskTuna » Thu May 06, 2021 5:56 am

Can I add multiple possible signatures for one file type? Does OR mean try signature1, try signature2 etc.?

Is this correct, will either of these signatures detect the file:
wallets.png
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
You do not have the required permissions to view the files attached to this post.

DiskTuna
Posts: 7
Joined: Mon Oct 12, 2020 11:21 am

Re: Question about custom file type OR and AND

Post by DiskTuna » Fri May 07, 2021 8:28 am

I was under the impression this forum was monitored by R-TT support..

Alt
Site Moderator
Posts: 2721
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Question about custom file type OR and AND

Post by Alt » Fri May 07, 2021 4:42 pm

DiskTuna wrote:
Thu May 06, 2021 5:56 am
Can I add multiple possible signatures for one file type?
Yes.
DiskTuna wrote:
Thu May 06, 2021 5:56 am
Does OR mean try signature1, try signature2 etc.?
OR means that if any of the signatures is found, the file will be identified as the file type.
AND means that all of the signatures must be found to identify the file as the file type.
DiskTuna wrote:
Thu May 06, 2021 5:56 am
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
One file is not enough to test its signature. To test a signature against its file type the following steps should be taken:
1. A flash drive should be full-formatted, that is, filled with zeros.
2. At least three files of the tested type should be written to the drive, those files should be separated by zeros.
3. The drive should be scanned, all file system should be disabled and only the tested file type should be enabled.
4. Both the beginning and end of the files should be identified correctly.

DiskTuna
Posts: 7
Joined: Mon Oct 12, 2020 11:21 am

Re: Question about custom file type OR and AND

Post by DiskTuna » Fri May 07, 2021 4:52 pm

Thank you! So my file would work, if any of the signatures is detected it should 'fire', right?

Alt
Site Moderator
Posts: 2721
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Question about custom file type OR and AND

Post by Alt » Fri May 07, 2021 5:26 pm

DiskTuna wrote:
Fri May 07, 2021 4:52 pm
Thank you! So my file would work, if any of the signatures is detected it should 'fire', right?
Right.

DiskTuna
Posts: 7
Joined: Mon Oct 12, 2020 11:21 am

Re: Question about custom file type OR and AND

Post by DiskTuna » Sat May 08, 2021 7:35 am

RAW wallet.dat recovery using R-Studio.

https://www.disktuna.com/recover-lost-o ... -r-studio/

Alt
Site Moderator
Posts: 2721
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Question about custom file type OR and AND

Post by Alt » Sun May 09, 2021 11:03 am

DiskTuna wrote:
Sat May 08, 2021 7:35 am
RAW wallet.dat recovery using R-Studio.

https://www.disktuna.com/recover-lost-o ... -r-studio/
Thank you for a very useful posting!

Post Reply