±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35522
New Yesterday: 2 Visitors: 121

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

file headers

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

flytnx
Member
 

file headers

Post Posted: Dec 07, 04 21:28

hi all,

i've got a question for anyone out there who may have encountered something similar. i am looking at some files which i believe could either possibly be encrypted or renamed. the files currently have .txt extentions however the content is not plaintext. my other theroy is that it is another file type which has just been renamed. i am trying to restore these files for a friends drive but he said his brother didn't have a clue what they were created in but that the file names were important to him.. anyhow anyone have any ideas? i was wondering if anyone could share some good url's for searching in hex file headers or possibly win32 file identification software? again, there is no obvious tagging in the files just that they all start with MWCR.

thx!  
 
  

Andy
Senior Member
 

Re: file headers

Post Posted: Dec 07, 04 21:35

Can you copy and paste some of the data into a post, the first few lines of code will do.

Andy  
 
  

flytnx
Member
 

Re: file headers

Post Posted: Dec 07, 04 21:40

MWCR·····ÖÕw0E··¦·······································································································································································································································································listing_of_a.txt···èÐÕwþ·2·
···!···@µä·········
···Ðä··ë··s_ÔwèÐÕwþ·2·
···!···@µä·····„ì··¿hJ·èÐÕwþ·2·
···!···@µä·„ì··$í··Ð䷐췷‚eG·ì··Ðä·$=J·$í··ì··Ðä·çgJ·$í··Ðä·Ð䷘‚ä·˜‚ä·X˜ä·························Të··Ï·6·äë··
9×wh›Ùwÿÿÿÿ3;ÔwõDÔ

- Andy
Can you copy and paste some of the data into a post, the first few lines of code will do.

Andy
 
 
  

Andy
Senior Member
 

Re: file headers

Post Posted: Dec 07, 04 22:23

I don't know what this is. It doesn't look like a file header. "ÐÕwþ·2· " seems to feature in the text and so does "···!···@µä" - try downloading WinHEx and taking a look at it in hex. It's possibly encryption but I don't know for sure.

A good site for searching file extensions: -

filext.com/  
 
  

flytnx
Member
 

Re: file headers

Post Posted: Dec 08, 04 05:36

merci Very Happy  
 
  

gmarshall139
Senior Member
 

Re: file headers

Post Posted: Dec 08, 04 15:39

.txt files wont have a specific header, it's just starts with the text of the file. I can't say that I've seen the header you posted. It may be some type of image format.
_________________
Greg Marshall, EnCE 
 
  

gmarshall139
Senior Member
 

Re: file headers

Post Posted: Dec 08, 04 16:03

.txt files wont have a specific header, it's just starts with the text of the file. I can't say that I've seen the header you posted. It may be some type of image format.
_________________
Greg Marshall, EnCE 
 

Page 1 of 2
Page 1, 2  Next