Orpheus BannerExchange
Orpheus BannerExchange

Musik Werbenetz - www.musica.at

Noten & mehr


Musiksoftware Forum » MP3 - Wave - WMA etc. Konvertierung » Ältere Beiträge 5 » IST MIR NOCH ZU HELFEN ????
« Zurück Weiter »

Autor Beitrag
Top of pagePrevious messageNext messageBottom of page Link to this message

Veröffentlicht am Dienstag, 09. März 2004 - 16:09 Uhr:   Schnellansicht    IP-Adresse sperren (Nur für Moderatoren)

Ich muss nach fehlgeschlegenem Partitionen zusammenfügen, Dateien recovern !
Das Recover-Prog (ontrack/easy recovery) arbeitet im RAW - Modus am passabelsten !

NUR : Die Cubase Projektdateien(.cpr/SX), um die es mir ja geht werden NICHT gefunden, da dieser Typ nicht definiert ist. Es besteht aber die Möglichkeit (meine wohl letzte) den Typ selbst zu definieren. Ich benötige genauere Info über den Kopf der CPR - Dateien! Das Folgende ist die Hilfestellung des Recover - Programms.


Before a user chooses to add a new file type for the RawRecovery to try to find on a disk the user must know three things:

1 - A unique signature for the file that is 8 bytes long or less

2 - How many bytes from the start of the file the signature starts

3 - The extension of the file

EasyRecovery has imposed some limits on these criteria.

-> The signature must be less than or equal to 8 bytes long, and all 8 bytes must be contiguous

-> The signature must start within the first 512 bytes of the file

-> The extension can only be 3 characters long

The first field:

This is where the signature goes. This is where the user will put up to 8 hex values (separated by spaces) representing the signature of the file. A byte is 8 bits and the maximum value for 8 bits is (11111111) is also the maximum 2 character hex value (FF). In the above example I have stated that the signature for the file is “10 20 30”. That means that somewhere in this file types there are 3 consecutive bytes that have the hex values of 10 then 20 then 30. You could also say that somewhere in the file there 24 consecutive bits that are “000100000010000000110000”. The program will except up to 8 valid 2 character hex values where valid is defined as anywhere in the range of 00 – FF. (Valid single character hex values are 0 to 9 and A to F).

The second field:

The offset is the number of bytes from the start of the file that the signature starts. In this example the offset is zero, so the first byte will equal 0x10 the second byte will equal 0x20 and the third byte will equal 0x30. As soon as the program finds those three bytes in that order it starts a new file right there. If the offset is greater than zero, when the program finds the byte signature, it backs up that many bytes from the start of the signature and starts the file right there.

The third field and fourth fields:

These fields are required, but are for the user’s reference and aren’t used by the recovery engine at all. When a raw recovery has completed any files that matched the new signature will be placed in a directory with the extension given.

Final word:
The user will want to be very careful about choosing signatures. Choosing a weak signature can (and probably will) yield false hits and doesn’t guarantee the files the user wants to find will be found. Conversely choosing a signature that is too strong can limit the search results more than the user wants. And finally simply choosing the wrong signature will of course yield incorrect results.

Here’s an example:
Lets say I was upset we don’t have .txt as a file type. So I open a bunch of text files in a hex editor and notice that at offset 39 they all have the same two bytes “0D 0A” So I create a file type like that and run it. The program spends the next 15 minutes scanning my 12Gb drive only to find that the files that do appear under my new file type are not text files and that the results are now skewed. I ran it on my machine and found 4000 files with that signature (the signature is a new line and carriage return, found in every text file). Unfortunately, this signature also resides in executables, so valid executables were being truncated and turned into my own file type. In fact when I examined the drive I ran it on, there were only 12 text files.


Falls es wirklich jemand bis hierher schafft, und jetzt auch noch eine Idee hat!?! ICH WÄRE UNENDLICH DANKBAR !

thx a lot
Top of pagePrevious messageNext messageBottom of page Link to this message

Veröffentlicht am Sonntag, 14. März 2004 - 00:31 Uhr:   Schnellansicht    IP-Adresse sperren (Nur für Moderatoren)


Wieviel wäre das in Geld ausgedrückt?