Hi guys,

I have created a partial image of a bad drive. The user requires his .PTF files back (Pro Logic). Normally I would just run the image through R-Studio (Or equivalent) and restore the files.

It is my understanding that R-Studio is unable to search for .PTF files (I may be wrong). Does anyone know of a program which can handle .PTF files?

Also... I have tried to manually search for .PTF files but I do not know what the file signature is? Does anyone know?

Many thanks!
DR

You may try to find the file signature of those files yourself. This article explains how: Creating a Custom Known File Type for R-Studio. The article is a little bit outdated, now you may create a description for a file type from a GUI: Customizing File Types.

_________________
R-Studio Data Recovery Software

You need to use Win hex and search for the file signature in the drive and then reconstruct them. I know one person who does this but not many who do it with much success. You might want to contact Quasimodo here on the forum and speak to him on this one. I know he does this and has got a good sucess rate on this one. Give him a PM and speak to him on this one. I know that RStudio can not do this and neither can Win Hex to search for this one they all seem to come back corrupted.

_________________
Iorana Haraharaini

I had success looking for .mts files using R-Studio custom file signature procedure once, but i was lucky. As Ann says, this is very difficult and not many people can do it.

What i did, in short, is i opened a known good .mts file in winhex and stripped off the signature. Then created the signature in R-Studio (described in link above by Alt(R-TT) ) and had R-Studio run the drive. It came back with a bunch off raw .mts files but most of them were good.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

I found so many file signatures using R-Studio that I can't count them. Some of the results are on our forum, some are built into R-Studio already. It's not a big deal if you have several good files of the type.
Generally, the success of such file recovery depends on tow things - files should be unfragmented, and there should be signatures for the beginning and end of the file.

_________________
R-Studio Data Recovery Software

I agree, if the files are relatively small and have a header and footer it should be a peace of cake. However what Ann was referring to are the larger files that have a complex file structure and are usually fragmented. That's a totally different story (Outlook, EDB, quickbooks, etc..)




I currently do not have access to any PTF files so i can't comment on the file structure, it would be best if you analyze a few sample files.

If files are fragmented, they cannot be recovered using file signatures anyway.
I suspect that this file type has a header and footer, in text form, which makes it rather easy to create a file type description for R-Studio, and in its turn, easy for R-Studio to find such files. And they shouldn't be large, as they don't contain audio tracks, and other multimedia.
I recommend Ann to create a couple of simple, and thus rather small, ptf files and look at their structure.

BTW, the worst case for file signature is when files have something like "rtqou" at the beginning and nothing at the end.

_________________
R-Studio Data Recovery Software

I recommend Ann to create a couple of simple, and thus rather small, ptf files and look at their structure.

I recommanded he seek quasimodo to help him with this one. He is the one who can rebuild and recover and this is what he said on this one However what Ann was referring to are the larger files that have a complex file structure and are usually fragmented. That's a totally different story (Outlook, EDB, quickbooks, etc..)

This was my post and my suggestion: You need to use Win hex and search for the file signature in the drive and then reconstruct them. I know one person who does this but not many who do it with much success. You might want to contact Quasimodo here on the forum and speak to him on this one. I know he does this and has got a good sucess rate on this one. Give him a PM and speak to him on this one. I know that RStudio can not do this and neither can Win Hex to search for this one they all seem to come back corrupted.

Hope this clear it up for you Alt(R-TT)

_________________
Iorana Haraharaini