Ontrack Easy Recovery Pro and file signatures

[FredThompson]

Josh is probably the best person to answer this:

Ontrack Easy Recovery Pro has a sector-level scanner to rebuild files from a crashed hard drive (RawRecovery.) However, the default list of supported file types doesn't include MPG, TY or the data files used by tytool.

Does anyone know the appropriate signature byte strings and offsets for these file types?

FWIW, you've got to REALLY mess up the hard drive to require this form of low-level scan. An example would be accidently formatting a drive. AdvancedRecovery seems to work fine if the partition definition gets "lost."

[BubbleLamp]

Originally posted by FredThompson
Josh is probably the best person to answer this:

Ontrack Easy Recovery Pro has a sector-level scanner to rebuild files from a crashed hard drive (RawRecovery.) However, the default list of supported file types doesn't include MPG, TY or the data files used by tytool.

Does anyone know the appropriate signature byte strings and offsets for these file types?

FWIW, you've got to REALLY mess up the hard drive to require this form of low-level scan. An example would be accidently formatting a drive. AdvancedRecovery seems to work fine if the partition definition gets "lost."

I don't know who you were targeting with this note, but OnTrack will do nothing for MFS files, it doesn't understand the file system.

[FredThompson]

I should have been more explicit: Windows hard drive

If Windows scotches up the file allocation, EasyRecovery can be used to restore files IF it knows what their headers look like.

The MPEGs Josh's tytool makes seem to have a different header than other MPEG files I've got. .ty header is easy to figure out as it has the string "Tivo" near the beginning.

I'm testing some strings right now. If this works, I'll post a proper how-to.

[FredThompson]

never mind, I've tracked this problem to NOT doing the registry fix for large hard drives in Win2K. Once you go over 137G on a drive and don't have the registry patched, you lose it all. No way to recover. Happened to me twice tonight. 250G of stuff gone.

Ugh.

So much for getting complete series this year.

Oh, well, I guess we only really learn something when we have pain. I learned a LOT tonight.

[larray]

What patch is this?

I've got a couple of drives I've gone over 137 gig on and haven't had any problems with, and I'm not aware of having applied any special patches to "enable" them. Granted they are connected to a PCI card since my normal pc bios/mobo doesn't handle disks over 137, but I'm not aware of the OS needing anything. Got a q article?

[FredThompson]

For Windows? Go to Maxtor's site. I don't remember the Q number. M$ broke their tech searvh engine again.