Custom File Signature with Fixed File Size

A forum on data recovery using the professional data recovery software R-STUDIO.
CesarSalinas
Posts: 1
Joined: Tue Nov 25, 2014 12:17 pm

Custom File Signature with Fixed File Size

Post by CesarSalinas » Tue Nov 25, 2014 12:29 pm

Hello,

I am about to buy R-Studio because I have a Pelco DVR that formatted the HDD when added a new drive, it is a partition type 0x83, I already add the custom signatures for the files and I did a scan using the Demo version, I found 65k files, that is great, but the files size are wrong, because the signature I did just have starting signature.

I know that the files from Pelco have a fixed size, 64MB, I order to buy R-Studio I need to know if there is a way to define the file size as part of the signature.

Here are the file Signatures I added:

<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="2.0">
<FileType id="50001" group="Metadata" description="Pelco DAT" features="" extension="dat">
<Begin combine="AND">
<Signature>\x00\x03LGEDB</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50002" group="Metadata" description="Pelco IDX" features="" extension="idx">
<Begin combine="AND">
<Signature>\x00\x03LGEIDX</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50003" group="Metadata" description="Pelco EVT" features="" extension="evt">
<Begin combine="AND">
<Signature>\x00\x03LGEEVT</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50004" group="Metadata" description="Pelco POS" features="" extension="pos">
<Begin combine="AND">
<Signature>\x00\x03LGEPOS</Signature>
</Begin>
<End combine="OR"/>
</FileType>
<FileType id="50005" group="Metadata" description="Pelco DAT" features="" extension="dat">
<Begin combine="AND">
<Signature>\x00\x03LGEDB</Signature>
</Begin>
<End combine="OR"/>
</FileType>
</FileTypeList>


Please help me!!

Thanks in advance,
Cesar

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File Signature with Fixed File Size

Post by Alt » Wed Nov 26, 2014 10:48 am

I cannot verify your file signatures, as I don't have a Pelco DVR.
Right now, R-Studio cannot specify file sizes for Known File Types, but we're going to implement that feature soon.

Data-Medics
Posts: 220
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Custom File Signature with Fixed File Size

Post by Data-Medics » Thu Nov 05, 2015 4:31 pm

This can actually be accomplished by using the file start also as the closing signature with an offset of the desired file size. It's not a glorious solution and takes a bit of tinkering to get it just right, but it works in most cases.

Post Reply