Custom File - MaxQDA

A forum on data recovery using the professional data recovery software R-STUDIO.
seeker_ole
Posts: 7
Joined: Sun Aug 05, 2012 6:44 am

Custom File - MaxQDA

Post by seeker_ole » Sun Aug 05, 2012 7:12 am

Hallo,

I reformatted a HFS+ partition and accidentally deleted some MaxQDA project files which I believed to have backuped but didn't. I tried to scan for the files (using R-Studio Windows Demo) but they were not found (the deleted, containing folder was found by using another recovery software for Mac, but the files were not found either). I am a total noob concerning file signatures and had a look at a hex editor to search for the signatures of the mx4-files, but I did not understand what is what actually.
I there a possibility to get help in this?
I have uploaded four example files to this location:
https://www.dropbox.com/sh/f5xmovewjf4svqp/swIrWT-1h9

Another question: Is it better to use R-Studio for Windows or for Mac in this regard? The files are on a Mac-formatted volume but the program (MaxQDA) that created the files is Windows only...

Thanks for any help!
Best,
BOK

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File - MaxQDA

Post by Alt » Mon Aug 06, 2012 2:11 pm

Actually, that doesn't matter much - R-Studio for Windows or Mac.
Try this file:
<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="2.0">
<FileType id="128" group="MaxQDA" description="MaxQDA Project file" features="" extension="mx4">
<Begin combine="OR">
<Signature>\x00\x01\x00\x00Standard\x20Jet\x20DB</Signature>
</Begin>
<End combine="OR"/>
</FileType>
</FileTypeList>

seeker_ole
Posts: 7
Joined: Sun Aug 05, 2012 6:44 am

Re: Custom File - MaxQDA

Post by seeker_ole » Thu Aug 23, 2012 4:41 am

Thank you for the file definition! And please excuse my late reply but I was without Internet the last 2 weeks due to business travels.

I scanned the disk using the file type definition and several files (32) were found - some are awfully large (beyond 1 GB which none of my original files had) and I can only open one of them with MaxQDA - the rest just crashes the program. The one that works is larger then its original was, too.
Can I tweak the scanning process in some way? Why are the files so bloated? Any checkboxes I can check/uncheck during recovery that might help with my issue?

Related to this, do you have a known file type definition for VirtualBox files (machine and/or hdd)?

Thank you again for your help! It is very much appreciated!
Best wishes!

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File - MaxQDA

Post by Alt » Thu Aug 23, 2012 7:13 am

The problem is, as I see it, that the MaxQDA files have no distinct file signature for their end. So, R-Studio can successfully find the beginning of a MaxQDA file, but it cannot definitely find its end. It determines the end by finding a beginning of the next file (not necessary another MaxQDA one!). That's why some files are so large. So, I'll save the recovered files and then try to find their actual ends by deep analysis of them. Unfortunately, I don't know much about this file type, so I can't give you more clues.

seeker_ole
Posts: 7
Joined: Sun Aug 05, 2012 6:44 am

Re: Custom File - MaxQDA

Post by seeker_ole » Thu Aug 23, 2012 5:14 pm

Thank you for the info.
As I am very new to this, how would do such a deep analysis?
Do I understand correctly, that all the found files are indeed MaxQDA-files but with a lot of extra baggage from other files? I would have to find the correct end of the files and the delete the rest (?) - then I should be able to open all of them?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File - MaxQDA

Post by Alt » Fri Aug 24, 2012 3:27 am

seeker_ole wrote:Thank you for the info.
As I am very new to this, how would do such a deep analysis?
Do I understand correctly, that all the found files are indeed MaxQDA-files but with a lot of extra baggage from other files? I would have to find the correct end of the files and the delete the rest (?) - then I should be able to open all of them?
Yes, if the original files aren't fragmented. If they are, the situation is much more complex, and it's unlikely that they can be recovered. I understand how difficult it may be, but this is the situation.

seeker_ole
Posts: 7
Joined: Sun Aug 05, 2012 6:44 am

Re: Custom File - MaxQDA

Post by seeker_ole » Fri Aug 24, 2012 7:05 am

OK, so how do I find the correct end of a file?
I am uploading the recovered, sub-GB files to this folder (should be done in a few hours):
https://www.dropbox.com/sh/f5xmovewjf4svqp/swIrWT-1h9
If you could have a look and check them/or give me a hint where to look and how to adjust the files, I would very much appreciate it!
The first file (1265.mx4) is the only one working.
Thank you!

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File - MaxQDA

Post by Alt » Mon Aug 27, 2012 9:09 am

I'm downloading the files and will look at them more closely to see what I can do.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom File - MaxQDA

Post by Alt » Tue Aug 28, 2012 5:36 am

I downloaded several files, but Microsoft Security Essentials warned me that they are "suspicious". So, I'll try to work with them in Linux.

seeker_ole
Posts: 7
Joined: Sun Aug 05, 2012 6:44 am

Re: Custom File - MaxQDA

Post by seeker_ole » Wed Sep 05, 2012 1:54 am

Thank you! Any luck with the files? Your help is very much appreciated!

Post Reply