File Signatures

Search for File Signatures and Define Custom Signatures

In case if recovery software is unable to detect deleted files after QuickScan or SuperScan (for example, when directory area keeping file headers is wiped out or overwritten by other data), the only chance to recover files is to search for file signatures.

In this case un-fragmented files can still be detected and recovered.

Active@ File Recovery comes with more than seventy predefined (internally programmed, very fast) standard file signatures to be analyzed while SuperScan (MS Office Documents, Photo Camera Image formats, ZIP/RAR Archives, Music & Video MP3/MP4, etc..). For expert users there is advanced programming language which allows to define custom file signatures for Active@ File Recovery to search for specific data formats.

Active@ File Recovery offers advanced tools to define user's templates for signatures to be analyzed. Signatures can be described using extended definition language RegExp (Regular Expressions).

To search for standard file signatures:

1. Start Active@ File Recovery and choose a disk or volume to be inspected (place a cursor on it)
2. Launch SuperScan dialog box and define SuperScan options
3. Select All Signatures or Documents & Photos only to be recognized, or click Signatures Recognition tab:
   
4. On a Signatures Recognition tab verify signatures to be processed and recognized:
   
   
5. Click Scan button and wait until some files have been recognized
6. Inspect specific groups in Signatures folder for files being detected
7. Preview and recover files (if detected) from specified groups

To preview, organize and recover files detected by signatures:

1. Select SuperScan node in the tree view on the left and Signature Files tab in the list view on the right
2. Expand general groups (Music, Documents) and specific sub-types (MP3, XLS,..) to inspect what is detected:
3. If file detected by signatures has some extended attributes, like AUTHOR, CREATED, TITLE, etc., these attributes will be displayed on the right. By default the only 5 first detected file attributes being displayed. To display more attributes, use Show Attributes drop down list
4. By default files are not sorted and displayed in the order of detection. To group files by attributes, click the column you want to sort on. If Subsequent Column Sorting option is turned ON, files are grouped & sorted on all columns followed the column you clicked. This could be convenient, for example, if you want to group music by Artist and then by Album
5. If you want to hide some attributes or change display order, click Organizer button on the toolbar toolbar to open Signature Files Organizer. Dialog appears and you can change the attribute for the particular file type (MP3, XLS, …) to be displayed in the particular column on the screen. For example, default column order for misic is Artist, Album, Title, Genre, Year,... To group MP3 first by Year, then by Artist, then by Album, change column order this way:
   And you will see:
   
   
6. To recover files detected by Signatures, select the particular file or group of files, or even all signature files and click Recover button. On Recovery Options dialog use Organize by file meta-data option to group files in folders based on attributes (meta-data):
7. Use Attribute-based folder depth parameter to organize recovered files in a specified number of sub-folders. For example, for the MP3 files default columns are Artist, Album, Title and default folder depth is 2. When you recover MP3s using default parameters, your music files will be organized first by Artist, then by Album, so all album songs will be in one folder. If you reorganize columns display like in example above (Year, Artist, Album,…) and specify folder depth 3, after recovery you'll have music grouped in folders first by Year, then by Artist, then by Album.

Custom File Signatures

Sometimes advanced users need to detect more specific file formats, not being described in standard set of file signatures. Active@ File Recovery offers advanced tools to define user's templates for signatures to be analyzed. Signatures can be described using extended definition language (including scripting and calculation capabilities) which also complies with RegExp (Regular Expressions). See language definition and syntax below.

To create and use a custom file signatures:

1. Create a text file containing one or multiple signatures definition (using syntax and examples below, or from supplied Custom_Signatures.txt)
2. Launch Active@ File Recovery, select disk or volume to be inspected, and click SuperScan button
3. In SuperScan options, File types to be recognized based on signatures area, choose Signatures Recognition tab
4. Load created text file contents into Signatures Tree
   • Click Load Custom Signatures button
   • Select a created text file containing signatures definition (
   • Find custom signatures in Signatures Tree and make sure that they are selected
5. Click Scan button to execute SuperScan
6. Inspect specific groups in Signatures Files panel for files being detected
7. Preview and recover files (if detected) from specified groups

Signatures definition language and examples:

; ===========================================================================================================
;                                 Signature Templates Usage
; ===========================================================================================================
; Empty lines and lines starting with semicolon are ignored
; Sections order and lines order in sections are not important
; Letter case is not important (excepting RegExp fields)
; -----------------------------------------------------------------------------------------------------------
; Section TEMPLATES - required and contains fields numbering from one
;       - TEMPLATE### - points to the section where signature template is described
; -----------------------------------------------------------------------------------------------------------
; Section Template Header - required and contains fields:
;     - BEGIN - required. Points to the section describing begin of the signature file
;     - FOOTER - required. Points to the section describing end of the signature file
;     - MAX_SIZE - non-required. Maximum file size to force file-end, if no file-end signature is detected. By default it is 64Kb.
;     - GROUP - non required. If missed - template goes to User Defined templates group by default 
;     - DESCRIPTION - non required. This is a descriptive name of user template being displayed on a screen
;     - EXTENSION - non required. This is a file extension to be displayed on a screen.
;
; -----------------------------------------------------------------------------------------------------------
; Section describing file beginning (required), contains fields of the same type:
;
;     signature = offset_start | offset_end
;
;     signature      - expression (regular or RegExp-compatible). Expression max length is 1024 bytes.
;     offset_start   - acceptable minimal signature offset from the beginning of the file
;     offset_end     - acceptable maximum signature offset from the beginning of the file
; 
;     If there are several fields listed in signature beginning, logical AND operation applied to confirm file start.
;
; -----------------------------------------------------------------------------------------------------------
; Section describing file end (not required), contains fields of the same type:
;
;     signature [= bytes_to_append]
;
;     signature       - expression (regular or RegExp-compatible). Expression max length is 1024 bytes.
;     bytes_to_append - not required. How many bytes to append to the file after the signature is found
;
;     If there are several fields listed in signature beginning, logical OR operation applied to define file end.


; ===========================================================================================================
;                                                Examples
; ===========================================================================================================

[TEMPLATES]
TEMPLATE1 = PRIMITIVE_HTML
TEMPLATE2 = PRIMITIVE_JPG

[PRIMITIVE_HTML]
DESCRIPTION = Primitive HTML Signature
EXTENSION = html
BEGIN=HTML_BEGIN
FOOTER=HTML_FOOTER
MAX_SIZE = 655360


[HTML_BEGIN]
<html = 0 | 512
<head = 0 | 1024

[HTML_FOOTER]
</html> = 2

[PRIMITIVE_JPG]
BEGIN=BEGIN.TEST.JPG
GROUP = Images and Camera RAW files
DESCRIPTION = Primitive JPG files
FOOTER=FOOTER-.TEST.JPG
EXTENSION = test.jpg
MAX_SIZE = 3221225472  
[BEGIN.TEST.JPG]
\xFF\xD8\xFF = 0 | 0

[FOOTER-.TEST.JPG]
\xFF\xD9
    
    

See Also

SuperScan