PhotoRec extension customization is taking parts not defined in the signature

when i tried to recover my .m files which are considered as .txt for photorec. I tried to add my own extension. After creating .m file containing the word tic while in the .photorec.sig file i added the following line

m 0 "tic"

it returns all files that begin with tic even if there is somthing else written after the word tic is the same line. I want to know if is there any way to seek for files without signature offset. For instance i want to seek for the word imread.

Thanks

1 Answer

I am currently working through a similar issue that required me to create my own .sig file. The best sources I have found are:

1. Add your own extension to PhotoRec

2. Autopsy User Documentation 4.1

In the first article it mentions using hexdump which is apart of "bsdmainutils" package. Use that to extract the hex representation of the file for a better match.

Ex: (I had to recover some MySQL DB files)

hexdump -C mysql-recovery/some-one-might-get-fired.myd | head

it will dump

00000000 03 0a b4 00 5d ca f4 ef f9 ff f7 ef 46 af 51 fc |....].......F.Q.|
00000010 ff 03 08 79 e2 fa 81 b6 ff ff ff 4b 85 53 fd f6 |...y.......K.S..|
00000020 ff ff dd bb fa f1 3c 00 dc ff ac ff 7f fb 7f bd |......<.........|
00000030 f8 01 7f 7a ff ff 5b fe 7f 63 00 0c 8f fe db fb |...z..[..c......|
00000040 ff 07 31 10 ec dd 33 09 00 00 01 31 00 00 00 03 |..1...3....1....|

I take only the first line but in some cases (see link 1) you might need a portion of the second line or other cases you will have to skip the first lines completely to find a pattern further down to properly identify the file.

For example an .idb file has the following header but with idb files the first rows are different from what I gather. So I need an offset to get to the portion of the file that has a signature that is the same across multiple idb files.

hexdump -s 0 -C mysql-recovery/users.ibd | head

00000000 c7 60 ef 59 00 00 00 00 00 00 00 00 00 00 00 00 |.`.Y............|
00000010 00 00 1b 32 0c 91 bd 99 00 08 00 00 00 00 00 00 |...2............|
00000020 00 00 00 00 01 11 00 00 01 11 00 00 00 00 00 00 |................|
00000030 14 00 00 00 12 40 00 00 00 00 00 00 00 38 00 00 |.....@.......8..|
00000040 00 01 00 00 00 00 0b b6 00 00 00 00 0b b6 00 00 |................|
00000050 00 03 00 00 00 00 01 16 00 00 00 00 00 9e 00 00 |................|
00000060 00 00 ff ff ff ff 00 00 ff ff ff ff 00 00 00 00 |................|
00000070 00 00 00 00 00 0b 00 00 00 00 ff ff ff ff 00 00 |................|
00000080 ff ff ff ff 00 00 00 00 00 01 00 00 00 02 00 26 |...............&|
00000090 00 00 00 02 00 26 00 00 00 00 00 00 00 00 00 00 |.....&..........|

The last two lines here are what I need based on comparisons that I have made looking at other .idb files. Count each pair of numbers as one and that is your offset. To test I run

hexdump -s 128 -C mysql-recovery/users.ibd | head

00000080 ff ff ff ff 00 00 00 00 00 01 00 00 00 02 00 26 |...............&|
00000090 00 00 00 02 00 26 00 00 00 00 00 00 00 00 00 00 |.....&..........|
000000a0 00 00 00 c6 ff ff ff ff 00 00 00 00 00 02 aa aa |................|
000000b0 ea ff ff ab ff bf ff bf ff ef ff ff fb fe 00 00 |................|
000000c0 00 00 00 00 00 00 00 00 00 00 01 16 00 00 00 00 |................|
000000d0 00 9e 00 00 00 02 bf ff fa fb ff bf ef ef bf ab |................|
000000e0 bf be fe ff ef fe 00 00 00 00 00 00 00 02 00 00 |................|
000000f0 00 00 02 ce 00 00 00 00 09 5e 00 00 00 04 aa aa |.........^......|
00000100 aa aa aa aa aa aa aa ab aa ba aa aa aa aa 00 00 |................|
00000110 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 |................|

My .photorec.sig file looks like this for .myd and .idb file types.

myd 0 0x030ab4005dcaf4eff9fff7ef46af51fc
idb 128 0xffffffff000000000001000000020026

The recovered file still needs to be tested but this is how I added a custom sig for the file type. I hope this helps others and please make corrections and I will edit the post.