R-Studio File Signature Settings

[ddrecovery]

I have some .r3d and .prproj files to find in a raw recovery as the drive has been reformatted. We did get some files in a general scan, but there are more that we need to find. I need to write code to get these files. I can understand the initial file signature in R-Studio and can get the initial part of the file (I have tested it). But I am confused about how to end the code. If the code is left blank the full file is not recovered. I have attached the R-Studio xml set up file I am using and also the start and end of a .r3d file.

Any help would be appreciated.

Attachments

RStudio File.JPG (17.31 KiB) Viewed 11068 times

[jermy]

In order to determine a signature you have to check and compare a few files
For example: in your case MAYBE the end signature might be

Code:

LOW\x20LIGHT\x20OPTIMIZED\x00\x05P\x99\x03\x00\x05P\x9A\x01\x00\x05P\x92\x00\x00\x00\x00\x00................

But again need to compare a few files to determine

[Alt(R-TT)]

We have an article Creating a Custom Known File Type for R-Studio that explains this process in detail.

[ddrecovery]

We have an article Creating a Custom Known File Type for R-Studio that explains this process in detail.

Thanks for the replies both. The raw search finds the r3d file okay, but stops well short of the full file. I am testing this file on a flash drive. The file is 700mb and the raw recovery stops at 200mb, so regardless of the ending file signature we don't get the full file. Is this just because of fragmentation?

Just copied the file onto a new flash drive and got a 284mb raw recovery, still well short of the full file volume.

[Alt(R-TT)]

Most likely R-Studio finds something looking like a beginning of another file and stops. You should disable all other file types.

[ddrecovery]

Most likely R-Studio finds something looking like a beginning of another file and stops. You should disable all other file types.

I have. The r3d files are the only file type being searched for, but still stops at random points for no apparent reason.

[fzabkar]

The raw search finds the r3d file okay, but stops well short of the full file. I am testing this file on a flash drive. The file is 700mb and the raw recovery stops at 200mb, so regardless of the ending file signature we don't get the full file. Is this just because of fragmentation?

Just copied the file onto a new flash drive and got a 284mb raw recovery, still well short of the full file volume.

Why not position the hex editor at the 284MB offset and examine the contents of the next sector?

If you know approximately how large the files should be, could you tell R-Studio to locate the RED2 headers and then carve out the next X sectors? Assuming they were not fragmented, would it matter if the recovered files were larger than the originals? Would they still play correctly?

[fzabkar]

PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types.

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec
https://git.cgsecurity.org/cgit/testdis ... file_r3d.c

It also understands .prproj (Adobe Premiere project) files:

http://git.cgsecurity.org/cgit/testdisk ... file_txt.c

[ddrecovery]

PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types.

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec
https://git.cgsecurity.org/cgit/testdis ... file_r3d.c

It also understands .prproj (Adobe Premiere project) files:

http://git.cgsecurity.org/cgit/testdisk ... file_txt.c

Thanks for the research fzabkar. I did go on a forum and there was a comment that Photorec didn't recognized these files but I guess that was an old post. I should have followed it up. In the meantime I have found a 'redundead' beta program (by the creators of r3d files) that runs through the Mac terminal, so I am running that at the moment. Its slow but it is picking up the r3d files.

In the interest of completeness I would like to know what I am doing wrong with setting up this search in R-Studio. I have attached a screenshot. I would imagine Alt(R-TT) would know instantly what I am doing wrong.

Attachments

Capture RStudio.JPG (34.32 KiB) Viewed 10963 times

[jermy]

Maybe other is more than 1 time appearances of that signature (end signature)
Open the file in n hex editor - like fzabkar suggested - and search for the end signature, if there is is more than 1 you have to put it too.
1 more thing have you tried to put the extra \x00 x8 to the end signature and use from: 0 Bytes ?

[Alt(R-TT)]

I need at least 3 such files to see what's wrong and what's right.

[ddrecovery]

PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types.

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec
https://git.cgsecurity.org/cgit/testdis ... file_r3d.c

It also understands .prproj (Adobe Premiere project) files:

Just so you know, although PhotoRec claims to get prproj files back, its no longer an optional file in the program, however r3d files still are.

[fzabkar]

Thanks for the feedback.