Custom signatures file size calculation syntax.
Custom (User Defined) File Signatures are saved in text file and can be edited by using simple text editor (like notepad) or by using Active@ UNDELETE tool: Custom (user defined) file signature templates on page 41.
User defined template reference
• Empty lines and lines starting with semicolon are ignored
• Sections order and lines order in sections are not important
• Letter case is not important (except RegExp fields)
Section TEMPLATES - required and contains fields numbering from one;
TEMPLATE### - points to the section where signature template is described (numbered from one).
Section Template Header - required and contains fields:
BEGIN
required. Points to the section describing begin of the signature file FOOTER
non required. Points to the section describing end of the signature file MAX_SIZE
non required. Maximum file size to force file-end, if no file-end signature is detected. By default it is 64Kb
GROUP
non required. If missed - template goes to User Defined templates group by default DESCRIPTION
non required. This is a descriptive name of user template being displayed on a screen EXTENSION
non required. This is a file extension to be assigned and displayed SCRIPT
non required. Refers to the section where size of the file being calculated
Note: If field SCRIPT is present, then field FOOTER is ignored in template header section.
Beginning of the file section
Section describing file beginning (required), contains fields of the same type:
<signature> = <offset_start> | <offset_end>
signature
expression (regular or Reg Exp-compatible). Expression max length is 1024 bytes offset_start
acceptable minimal signature offset from the beginning of the file offset_end
acceptable maximum signature offset from the beginning of the file
Note: If there are several fields listed in signature beginning, logical AND operation applied to confirm file start.
End of file section
Section describing file end (not required), contains fields of the same type:
<signature> [= <bytes_to_append>]
signature
expression (regular or RegExp-compatible). Expression max length is 1024 bytes bytes_to_append
not required. How many bytes to append to the file after the signature is found
Note: If there are several fields listed in signature, logical OR operation applied to define file end.
File size calculation script
Section calculating file size (not required), contains operators of four types:
<result> = <command> (<argument>, <argument>) <result> = <argument>
IF (<argument> <condition> <argument>) GOTO <label>
GOTO <label>
commands
READ, ENDIAN, SUM, SUB, MUL, DIV, SHR, SHL, AND, OR and XOR Most of commands are the same as in assembler programming language, except:
READ - first argument - data type (size) to be read, second - offset from the beginning of the file
ENDIAN - first argument - data type (size), second - expression, which byte order will be swapped First argument for commands READ and ENDIAN must be one of reserved data types: BYTE, WORD, DWORD, QWORD
argument
can be either a named variable or a constant result
can be the only named variable condition
can be one of : < <= == >= > != (meaning is the same as in C++) label
consists of label name followed by colon and it can precede any operator Note:
• Label named EXIT has been reserved and instructs to complete the calculations
• Named variable SIZE has been reserved and keeps the file size
• Constants can be in Decimal form, Binary (followed by 'b'), Octal ('o'), and Hexadecimal ('h') or can be a text string
EXTENSION=djvu
DESCRIPTION=QuickBooks Document EXTENSION=qbw
size = 0
temp = endian(dword, temp) size = sum(size, temp) goto next
[CAB_HEADER]
DESCRIPTION=Microsoft Compressed Archive CAB EXTENSION=cab
if (rastr_size < pixel) goto exit
Active@ UNDELETE is an advanced data recovery tool designed to recover data lost or deleted data, or even information from formatted hard disks.
A wildcard is a character that can be used as a substitute for any of a class of characters in a search. Wildcard characters are often used in place of one or more characters when you do not know what the real character is or you do not want to enter the entire name. In Active@ UNDELETE three types of wildcard are used: star or asterisk(*), question mark (?) and number sign (#).
Wildcard characters are used in the File Filter Toolbar on page 40 and Search for deleted Files and Folders on page 37.
Examples of using wildcards:
Wildcard character Example Description
Asterisk (*) docum* Use the asterisk as a substitute
for zero or more characters if you are looking for a file that you know what it starts with and you cannot remember the rest of the file name. The example locates all files of any file type that begin with "docum" including documents.txt, document_01.doc and documentum.doc.
docum*.doc To narrow the search to a specific
type of file, include the file extension. The example locates all files that begin with "docum" and have the file name extension .doc, such as document_01.doc and documentum.doc.
Question mark (?) doc?.doc Use the question mark as a substitute
for a single character in a file name.
In the example, you will locate the file docs.doc or doc1.doc but not documents.doc.
Number sign (#) doc_###.doc Use the number sign (also known
as the pound or hash sign) as a substitute for a single number in a name. In the example, you will locate the file doc_012.doc or doc_211.doc but not doc_ABS.doc.