I have some .r3d and .prproj files to find in a raw recovery as the drive has been reformatted. We did get some files in a general scan, but there are more that we need to find. I need to write code to get these files. I can understand the initial file signature in R-Studio and can get the initial part of the file (I have tested it). But I am confused about how to end the code. If the code is left blank the full file is not recovered. I have attached the R-Studio xml set up file I am using and also the start and end of a .r3d file.

Any help would be appreciated.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

In order to determine a signature you have to check and compare a few files
For example: in your case MAYBE the end signature might be

But again need to compare a few files to determine

We have an article Creating a Custom Known File Type for R-Studio that explains this process in detail.

_________________
R-Studio Data Recovery Software

Thanks for the replies both. The raw search finds the r3d file okay, but stops well short of the full file. I am testing this file on a flash drive. The file is 700mb and the raw recovery stops at 200mb, so regardless of the ending file signature we don't get the full file. Is this just because of fragmentation?

Just copied the file onto a new flash drive and got a 284mb raw recovery, still well short of the full file volume.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Most likely R-Studio finds something looking like a beginning of another file and stops. You should disable all other file types.

_________________
R-Studio Data Recovery Software

I have. The r3d files are the only file type being searched for, but still stops at random points for no apparent reason.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Why not position the hex editor at the 284MB offset and examine the contents of the next sector?

If you know approximately how large the files should be, could you tell R-Studio to locate the RED2 headers and then carve out the next X sectors? Assuming they were not fragmented, would it matter if the recovered files were larger than the originals? Would they still play correctly?

_________________
A backup a day keeps DR away.

PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types.

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec
https://git.cgsecurity.org/cgit/testdis ... file_r3d.c

It also understands .prproj (Adobe Premiere project) files:

http://git.cgsecurity.org/cgit/testdisk ... file_txt.c

_________________
A backup a day keeps DR away.

Thanks for the research fzabkar. I did go on a forum and there was a comment that Photorec didn't recognized these files but I guess that was an old post. I should have followed it up. In the meantime I have found a 'redundead' beta program (by the creators of r3d files) that runs through the Mac terminal, so I am running that at the moment. Its slow but it is picking up the r3d files.

In the interest of completeness I would like to know what I am doing wrong with setting up this search in R-Studio. I have attached a screenshot. I would imagine Alt(R-TT) would know instantly what I am doing wrong.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Maybe other is more than 1 time appearances of that signature (end signature)
Open the file in n hex editor - like fzabkar suggested - and search for the end signature, if there is is more than 1 you have to put it too.
1 more thing have you tried to put the extra \x00 x8 to the end signature and use from: 0 Bytes ?

I need at least 3 such files to see what's wrong and what's right.

_________________
R-Studio Data Recovery Software

Just so you know, although PhotoRec claims to get prproj files back, its no longer an optional file in the program, however r3d files still are.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

Thanks for the feedback.

_________________
A backup a day keeps DR away.