| Author | Message | ||
     A. Murphy Username: x1ngxang Registered: N/A |
I am SO happy that I've found this forum... and Stephen really knows his stuff! So here's the situation... I've completed a recovery on a disk with mechanical failures, and I've run into an issue with docx, ppt, pptx, and pdf files that did not recover properly. While the file and filename exists, the associated application will not open the files without error. Looking at the files with WinHex, it looks like the data is still there, so I'm thinking some "file carving" is in order. Using the file signatures from http://www.garykessler.net/library/file_sigs.html, I'd like to try my hand at manually rebuilding them. Can anyone provide input that would help me out? | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
IMO you don't need that signature list, and you don't need to manually rebuild them (unless they are fragmented), just use the automated file header signature search with the already defined signatures and the intelligent internal file size detection algorithm, in WinHex (with a specialist license) or X-Ways Forensics. |