HDD GURU FORUMS :: View topic - R-Studio File Signature Settings

HDD GURU FORUMS http://forum.hddguru.com/

R-Studio File Signature Settings http://forum.hddguru.com/viewtopic.php?f=7&t=33480	Page 1 of 1

Author:

ddrecovery [ May 19th, 2016, 19:39 ]

Post subject:

R-Studio File Signature Settings

I have some .r3d and .prproj files to find in a raw recovery as the drive has been reformatted. We did get some files in a general scan, but there are more that we need to find. I need to write code to get these files. I can understand the initial file signature in R-Studio and can get the initial part of the file (I have tested it). But I am confused about how to end the code. If the code is left blank the full file is not recovered. I have attached the R-Studio xml set up file I am using and also the start and end of a .r3d file.

Any help would be appreciated.

Attachments:

RStudio File.JPG [ 17.31 KiB | Viewed 15351 times ]

r3d File Header.JPG [ 48.04 KiB | Viewed 15351 times ]

r3d File End.JPG [ 56.72 KiB | Viewed 15351 times ]

Author:	jermy [ May 19th, 2016, 23:38 ]
Post subject:	Re: R-Studio File Signature Settings
In order to determine a signature you have to check and compare a few files For example: in your case MAYBE the end signature might be Code: LOW\x20LIGHT\x20OPTIMIZED\x00\x05P\x99\x03\x00\x05P\x9A\x01\x00\x05P\x92\x00\x00\x00\x00\x00................ But again need to compare a few files to determine

Author:	Alt(R-TT) [ May 20th, 2016, 6:22 ]
Post subject:	Re: R-Studio File Signature Settings
We have an article Creating a Custom Known File Type for R-Studio that explains this process in detail.

Author:	ddrecovery [ May 20th, 2016, 13:50 ]
Post subject:	Re: R-Studio File Signature Settings
Alt(R-TT) wrote: We have an article Creating a Custom Known File Type for R-Studio that explains this process in detail. Thanks for the replies both. The raw search finds the r3d file okay, but stops well short of the full file. I am testing this file on a flash drive. The file is 700mb and the raw recovery stops at 200mb, so regardless of the ending file signature we don't get the full file. Is this just because of fragmentation? Just copied the file onto a new flash drive and got a 284mb raw recovery, still well short of the full file volume.

Author:	Alt(R-TT) [ May 20th, 2016, 18:57 ]
Post subject:	Re: R-Studio File Signature Settings
Most likely R-Studio finds something looking like a beginning of another file and stops. You should disable all other file types.

Author:	ddrecovery [ May 20th, 2016, 19:14 ]
Post subject:	Re: R-Studio File Signature Settings
Alt(R-TT) wrote: Most likely R-Studio finds something looking like a beginning of another file and stops. You should disable all other file types. I have. The r3d files are the only file type being searched for, but still stops at random points for no apparent reason.

Author:	fzabkar [ May 20th, 2016, 19:29 ]
Post subject:	Re: R-Studio File Signature Settings
ddrecovery wrote: The raw search finds the r3d file okay, but stops well short of the full file. I am testing this file on a flash drive. The file is 700mb and the raw recovery stops at 200mb, so regardless of the ending file signature we don't get the full file. Is this just because of fragmentation? Just copied the file onto a new flash drive and got a 284mb raw recovery, still well short of the full file volume. Why not position the hex editor at the 284MB offset and examine the contents of the next sector? If you know approximately how large the files should be, could you tell R-Studio to locate the RED2 headers and then carve out the next X sectors? Assuming they were not fragmented, would it matter if the recovered files were larger than the originals? Would they still play correctly?

Author:	fzabkar [ May 20th, 2016, 19:53 ]
Post subject:	Re: R-Studio File Signature Settings
PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types. http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec https://git.cgsecurity.org/cgit/testdis ... file_r3d.c It also understands .prproj (Adobe Premiere project) files: http://git.cgsecurity.org/cgit/testdisk ... file_txt.c

Author:

ddrecovery [ May 20th, 2016, 20:06 ]

Post subject:

Re: R-Studio File Signature Settings

fzabkar wrote:

PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types.

http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec
https://git.cgsecurity.org/cgit/testdis ... file_r3d.c

It also understands .prproj (Adobe Premiere project) files:

http://git.cgsecurity.org/cgit/testdisk ... file_txt.c

Thanks for the research fzabkar. I did go on a forum and there was a comment that Photorec didn't recognized these files but I guess that was an old post. I should have followed it up. In the meantime I have found a 'redundead' beta program (by the creators of r3d files) that runs through the Mac terminal, so I am running that at the moment. Its slow but it is picking up the r3d files.

In the interest of completeness I would like to know what I am doing wrong with setting up this search in R-Studio. I have attached a screenshot. I would imagine Alt(R-TT) would know instantly what I am doing wrong.

Attachments:

Capture RStudio.JPG [ 34.32 KiB | Viewed 15246 times ]

Author:	jermy [ May 21st, 2016, 15:53 ]
Post subject:	Re: R-Studio File Signature Settings
Maybe other is more than 1 time appearances of that signature (end signature) Open the file in n hex editor - like fzabkar suggested - and search for the end signature, if there is is more than 1 you have to put it too. 1 more thing have you tried to put the extra \x00 x8 to the end signature and use from: 0 Bytes ?

Author:	Alt(R-TT) [ May 23rd, 2016, 12:52 ]
Post subject:	Re: R-Studio File Signature Settings
I need at least 3 such files to see what's wrong and what's right.

Author:	ddrecovery [ May 24th, 2016, 16:40 ]
Post subject:	Re: R-Studio File Signature Settings
ddrecovery wrote: fzabkar wrote: PhotoRec (freeware) understands the .r3d (RED2 and RED1) file types. http://www.cgsecurity.org/wiki/File_For ... y_PhotoRec https://git.cgsecurity.org/cgit/testdis ... file_r3d.c It also understands .prproj (Adobe Premiere project) files: Just so you know, although PhotoRec claims to get prproj files back, its no longer an optional file in the program, however r3d files still are.

Author:	fzabkar [ May 24th, 2016, 17:55 ]
Post subject:	Re: R-Studio File Signature Settings
Thanks for the feedback.

Page 1 of 1	All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/