Page 1 of 1

Custom File Signature with Fixed File Size

Posted: Tue Nov 25, 2014 12:29 pm
by CesarSalinas
Hello,

I am about to buy R-Studio because I have a Pelco DVR that formatted the HDD when added a new drive, it is a partition type 0x83, I already add the custom signatures for the files and I did a scan using the Demo version, I found 65k files, that is great, but the files size are wrong, because the signature I did just have starting signature.

I know that the files from Pelco have a fixed size, 64MB, I order to buy R-Studio I need to know if there is a way to define the file size as part of the signature.

Here are the file Signatures I added:

<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="2.0">
<FileType id="50001" group="Metadata" description="Pelco DAT" features="" extension="dat">
<Begin combine="AND">
<Signature>\x00\x03LGEDB</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50002" group="Metadata" description="Pelco IDX" features="" extension="idx">
<Begin combine="AND">
<Signature>\x00\x03LGEIDX</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50003" group="Metadata" description="Pelco EVT" features="" extension="evt">
<Begin combine="AND">
<Signature>\x00\x03LGEEVT</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50004" group="Metadata" description="Pelco POS" features="" extension="pos">
<Begin combine="AND">
<Signature>\x00\x03LGEPOS</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50005" group="Metadata" description="Pelco DAT" features="" extension="dat">
<Begin combine="AND">
<Signature>\x00\x03LGEDB</Signature>
</Begin>
<End combine="OR"/>
</FileType>
</FileTypeList>


Please help me!!

Thanks in advance,
Cesar

Re: Custom File Signature with Fixed File Size

Posted: Wed Nov 26, 2014 10:48 am
by Alt
I cannot verify your file signatures, as I don't have a Pelco DVR.
Right now, R-Studio cannot specify file sizes for Known File Types, but we're going to implement that feature soon.

Re: Custom File Signature with Fixed File Size

Posted: Thu Nov 05, 2015 4:31 pm
by Data-Medics
This can actually be accomplished by using the file start also as the closing signature with an offset of the desired file size. It's not a glorious solution and takes a bit of tinkering to get it just right, but it works in most cases.