Creating a Custom Known File Type for R-Studio

A forum on data recovery using the professional data recovery software R-STUDIO.
powermax
Posts: 2
Joined: Thu Jul 16, 2020 2:55 am

Creating a Custom Known File Type for R-Studio

Post by powermax » Thu Jul 16, 2020 3:16 am

I need to create a custom know file type.
I readed all instruction on https://www.r-studio.com/creating-custo ... %20damaged .

common Begin of file is : \x09\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x6D\x64\x35\x00\x00\x00
common End of file is : \x69\x62\x53\x75\x6D\x6D\x61\x72\x79\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

XML generated by r-studio is :

<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="2.0">
<FileType id="50001" group="Archive" description="Veeam Backup" features="" extension="vbk">
<Begin combine="OR">
<Signature>\x09\x00\x00\x00\x01\x00\x00\x00\x03\x00\x00\x00\x6D\x64\x35\x00\x00\x00</Signature>
</Begin>
<End combine="OR">
<Signature offset="20">\x69\x62\x53\x75\x6D\x6D\x61\x72\x79\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00</Signature>
</End>
</FileType>
</FileTypeList>

The problem is that the common End signature is on the middle of file too, and R-Studio break recovery when see it and do not go until the real end of file.

How i can tell to r-studio to go until the last common End signature ?

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Creating a Custom Known File Type for R-Studio

Post by Alt » Fri Jul 17, 2020 12:58 pm

This is a common problem for Known File Types. Right now the way out is only one: recover the first part of the file, then the rest of the pieces which have only the end signature and "glue" them manually.

powermax
Posts: 2
Joined: Thu Jul 16, 2020 2:55 am

Re: Creating a Custom Known File Type for R-Studio

Post by powermax » Tue Jul 21, 2020 3:16 am

Thanks for the tip. But is it not possible to count how many instances for the end of the file are found and set the end of reading the file when XXX instances are found? Or if that instance is not found for XXX bytes?

RForce
Posts: 77
Joined: Wed Jul 09, 2014 9:05 am

Re: Creating a Custom Known File Type for R-Studio

Post by RForce » Mon Jul 27, 2020 8:38 am

How would R-Studio know if the 2nd instance is part of the file or the start of a new file, due to fragmentation or because of a false positive of the first instance?

Post Reply