Acronis, user defined FileType

A forum on data recovery using the professional data recovery software R-STUDIO.
hanspet2

Acronis, user defined FileType

Post by hanspet2 » Thu Sep 21, 2017 5:17 am

Hi,

i try to recover TIB-Files from Acronis 2017 and 2018. I have read many Acronisfiles from my Harddisk with WinHEX.

The Begin and the End of all my Acronis Files are the same.

Begin : (HEX) CE 24 B9 A2 20 00 00 00
End: (HEX) 00 00 00 20 A2 B9 24 CE

If i try to defined customer Filetype like : (Example from R-Studio)
<FileType id="50001" group="Multimedia Video" description="Sony cam video, XDCam-EX" extension="mp4">
<Signature>\x00\x00\x00\x18ftypmp42\x00\x00\x00\x00mp42\x00\x00\x00\x00\x00\x00\x00\x08free</Signature>
<Signature from="end" offset="21">\x3C\x2FNonRealTimeMeta\x3E\x0D\x0A\x00</Signature>
</FileType>
</FileTypeList>
it dont works.

Can somebody help me to make a working .xml File to import it in R-Studio ?
Or can somebody show me how a have to do it with the Data from my Files.

best regards

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Acronis, user defined FileType

Post by Alt » Thu Sep 21, 2017 2:21 pm

This should work:

Code: Select all

<FileTypeList>
 <FileType id="50001" group="Acronis" description="Acronis TIB file" extension="tib">
   <Begin combine="and">
        <Signature>\xCE\x24\xB9\xA\x20\x00\x00\x00</Signature>
   <\Begin>
   <End combine="and">
        <Signature from="end" offset="7">\x00\x00\x00\x20\xA2\xB9\x24\xCE</Signature>
   </End>
 </FileType>
</FileTypeList>

Data-Medics
Posts: 148
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Acronis, user defined FileType

Post by Data-Medics » Sun Sep 24, 2017 11:16 am

Also, if you're specifically trying to target these files, you'll probably want to disable all other file types when scanning. Because these files are large and likely to contain hundreds of other common file types inside them (albeit in a compressed state) it's likely to get some false positives from inside the image files which will make it carve out improperly.

So do your scan with only your custom XML enabled. You'll get better results.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Acronis, user defined FileType

Post by Alt » Sun Sep 24, 2017 5:50 pm

And remember, Acronis files are huge and may be fragmented.

Post Reply