Page 1 of 1
Question about custom file type OR and AND
Posted: Thu May 06, 2021 5:56 am
by DiskTuna
Can I add multiple possible signatures for one file type? Does OR mean try signature1, try signature2 etc.?
Is this correct, will either of these signatures detect the file:
wallets.png
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
Re: Question about custom file type OR and AND
Posted: Fri May 07, 2021 8:28 am
by DiskTuna
I was under the impression this forum was monitored by R-TT support..
Re: Question about custom file type OR and AND
Posted: Fri May 07, 2021 4:42 pm
by Alt
DiskTuna wrote: ↑Thu May 06, 2021 5:56 am
Can I add multiple possible signatures for one file type?
Yes.
DiskTuna wrote: ↑Thu May 06, 2021 5:56 am
Does OR mean try signature1, try signature2 etc.?
OR means that if any of the signatures is found, the file will be identified as the file type.
AND means that all of the signatures must be found to identify the file as the file type.
DiskTuna wrote: ↑Thu May 06, 2021 5:56 am
And one suggestion: DMDE has this nice 'test' button, which allows you to test your newly made signature against a known good file. That would be a simple and nice addition to R-Studio too.
One file is not enough to test its signature. To test a signature against its file type the following steps should be taken:
1. A flash drive should be full-formatted, that is, filled with zeros.
2. At least three files of the tested type should be written to the drive, those files should be separated by zeros.
3. The drive should be scanned, all file system should be disabled and only the tested file type should be enabled.
4. Both the beginning and end of the files should be identified correctly.
Re: Question about custom file type OR and AND
Posted: Fri May 07, 2021 4:52 pm
by DiskTuna
Thank you! So my file would work, if any of the signatures is detected it should 'fire', right?
Re: Question about custom file type OR and AND
Posted: Fri May 07, 2021 5:26 pm
by Alt
DiskTuna wrote: ↑Fri May 07, 2021 4:52 pm
Thank you! So my file would work, if any of the signatures is detected it should 'fire', right?
Right.
Re: Question about custom file type OR and AND
Posted: Sat May 08, 2021 7:35 am
by DiskTuna
Re: Question about custom file type OR and AND
Posted: Sun May 09, 2021 11:03 am
by Alt
Thank you for a very useful posting!