Data Recovery & Specific Filetypes issue

[einstein9]

Guys,

i have a strange case here which i wanted to share with you,,

I got SCSI HDD, formatted by stupid guy, and the OS is Sco Unix (for some Specific purpose) and application, again i dono the app. name but its for the oil sector issue.

the problem is the following:

I`ve been asked to get the deleted/formatted files from the HDD which has the following extensions:

.rdr
.xtf
.aff

I did the following:

Used, R-Studio 5.1 and made an Image of the Drive (70GB) i tried the Winhex to see those files with the mentioned extension and did manage to find alot.

the Problem:

R-Studio is so stupid, but it is good, it has built-in filetypes i.e. DOC,XLS whatever, but it does not include those mentioned types, i was reading about those issues and managed to know that you can use Customized XML where you can assign those types, but i did not get it yet.

- Is there any way to extract those files from the HDD Image?
Or
- How do i extract those files only from the Disk Image i created?

any clues/help here plz

thnx

Attached: sample files which i got from them to get the file header/id

Attachments

sample_rdr_xtf_aff.rar

(216.29 KiB) Downloaded 279 times

[einstein9]

OR:

How do i force the R-Studio to look for those Extensions only??

[DR-Kiev]

Forget R-studio.
Use WinHex:

-Tools - Disk Tools- File Recovery byType..
Click Signatures
It will open txt file with well-known signatures.
Integrate yours (find some uniq header , save its offset) .

[ppumkin]

.aff (for this instance only) version 3
BEGIN - 41 46 46 20 52 65 76 2E 20 58 2E 63 - OFFSET 0X38
END - ? More samples

waiting for more samples

[einstein9]

Forget R-studio.
Use WinHex:

-Tools - Disk Tools- File Recovery byType..
Click Signatures
It will open txt file with well-known signatures.
Integrate yours (find some uniq header , save its offset) .

many thnx for the tip working on it
mean while, am trying to use the D.E. and see in both cases

thnx again

[einstein9]

.aff (for this instance only) version 3
BEGIN - 41 46 46 20 52 65 76 2E 20 58 2E 63 - OFFSET 0X38
END - ? More samples

waiting for more samples

thnx man for this,,,, working on it

[ppumkin]

.aff (for this instance only) version 3
BEGIN - 41 46 46 20 52 65 76 2E 20 58 2E 63 - OFFSET 0X38
END - 00 00 00 30 00 00 00 00



The Signature seems the same on all file from OFFset 0- but offset 0x38 Identifies it as AFF

00000000 00 01 00 00 00 00 00 00 00 00 00 30 00 00 00 00
00000010 00 65 00 00 00 00 00 30 00 00 00 D0 00 00 00 00
00000020 00 01 00 00 00 00 09 78 00 00 00 30 00 00 00 00
00000030 00 00 00 00 00 00 00 00 41 46 46 20 52 65 76 2E
00000040 20 58 2E 36 00 00 00 00 00 00 00 00 00 00 00 00

Checking the other ones now. Will make you a winhex/rstudio file.

[ppumkin]

.rdr (no idea- some real time text data about pumps and then some encoded data near the end)
BEGINNING- 00 00 00 00 00 00 00 88 6B 31 31 33 62 -OFFSET 0X00
END - 00 00 00 00 00 00 00 00 00 10 00 00 00 0C 58 54 00 00 00

after the end signature there is always another 7bytes of data ? that is always different- I am not sure if this could make the file unreadable by the software?
{ 11 32 B4 00 00 00 00 } ; {08 5B B0 00 00 00 00 } , etc... Not text- just some values.

Last edited by ppumkin on October 11th, 2010, 12:45, edited 1 time in total.

[einstein9]

.aff (for this instance only) version 3
BEGIN - 41 46 46 20 52 65 76 2E 20 58 2E 63 - OFFSET 0X38
END - 00 00 00 30 00 00 00 00



The Signature seems the same on all file from OFFset 0- but offset 0x38 Identifies it as AFF

00000000 00 01 00 00 00 00 00 00 00 00 00 30 00 00 00 00
00000010 00 65 00 00 00 00 00 30 00 00 00 D0 00 00 00 00
00000020 00 01 00 00 00 00 09 78 00 00 00 30 00 00 00 00
00000030 00 00 00 00 00 00 00 00 41 46 46 20 52 65 76 2E
00000040 20 58 2E 36 00 00 00 00 00 00 00 00 00 00 00 00

Checking the other ones now. Will make you a winhex/rstudio file.

many thnx ppumkin for ur time here also reading/working/replying

[ppumkin]

Ok- I see why you were struggling. I tried to do a few tests in R-Studio and it never found anything. Even i tried a simple file and it did not work. I must be doing something wrong. I read the manual over and over and over... i dont understand what the problem can be

I used HexEdit like suggested by DR-Kiev - Finds them straight away using the same GREP syntax. I must be typing something incorrect on the Rstudio

Put this into the WinhexDirectory and try to scan. I tested it on a formatted media- and it finds the signatures ok. But i dont know how well it will work on crowded data.

You can edit the file in excel and see the signatures.

Attachments

oil-File-Signatures.zip

(296 Bytes) Downloaded 266 times

[einstein9]

Ok- I see why you were struggling. I tried to do a few tests in R-Studio and it never found anything. Even i tried a simple file and it did not work. I must be doing something wrong. I read the manual over and over and over... i dont understand what the problem can be

I used HexEdit like suggested by DR-Kiev - Finds them straight away using the same GREP syntax. I must be typing something incorrect on the Rstudio

Put this into the WinhexDirectory and try to scan. I tested it on a formatted media- and it finds the signatures ok. But i dont know how well it will work on crowded data.

You can edit the file in excel and see the signatures.

thnx man for your help/time i did managed to get them, i sent my client some samples to try and confirm which i hope will work with him.

It did work in Winhex and i will inform you with the updates
many thnx man really

[einstein9]

I Would like to 1st. Thank the following:

DR-Kiev ppumkin

for their time/help and also Tips

more goes really to ppumkin because of the work on Winhex and DR-Kiev for the quick reply

I also wanted to Thank AceLab Technical Support Specially Mr. Roustam for his time and work on this case, i did manage with the help of Acelab TS to find a solution on this case and get the Client Files

Many Thnx really to all of you