Page 1 of 1

Acronis, user defined FileType

Posted: Thu Sep 21, 2017 5:17 am
by hanspet2
Hi,

i try to recover TIB-Files from Acronis 2017 and 2018. I have read many Acronisfiles from my Harddisk with WinHEX.

The Begin and the End of all my Acronis Files are the same.

Begin : (HEX) CE 24 B9 A2 20 00 00 00
End: (HEX) 00 00 00 20 A2 B9 24 CE

If i try to defined customer Filetype like : (Example from R-Studio)
<FileType id="50001" group="Multimedia Video" description="Sony cam video, XDCam-EX" extension="mp4">
<Signature>\x00\x00\x00\x18ftypmp42\x00\x00\x00\x00mp42\x00\x00\x00\x00\x00\x00\x00\x08free</Signature>
<Signature from="end" offset="21">\x3C\x2FNonRealTimeMeta\x3E\x0D\x0A\x00</Signature>
</FileType>
</FileTypeList>
it dont works.

Can somebody help me to make a working .xml File to import it in R-Studio ?
Or can somebody show me how a have to do it with the Data from my Files.

best regards

Re: Acronis, user defined FileType

Posted: Thu Sep 21, 2017 2:21 pm
by Alt
This should work:

Code: Select all

<FileTypeList>
 <FileType id="50001" group="Acronis" description="Acronis TIB file" extension="tib">
   <Begin combine="and">
        <Signature>\xCE\x24\xB9\xA\x20\x00\x00\x00</Signature>
   <\Begin>
   <End combine="and">
        <Signature from="end" offset="7">\x00\x00\x00\x20\xA2\xB9\x24\xCE</Signature>
   </End>
 </FileType>
</FileTypeList>

Re: Acronis, user defined FileType

Posted: Sun Sep 24, 2017 11:16 am
by Data-Medics
Also, if you're specifically trying to target these files, you'll probably want to disable all other file types when scanning. Because these files are large and likely to contain hundreds of other common file types inside them (albeit in a compressed state) it's likely to get some false positives from inside the image files which will make it carve out improperly.

So do your scan with only your custom XML enabled. You'll get better results.

Re: Acronis, user defined FileType

Posted: Sun Sep 24, 2017 5:50 pm
by Alt
And remember, Acronis files are huge and may be fragmented.