Hi,
Could somebody advise what program would open an image with the file header of 0x00 00 02 00.
Thanks in advance
Could somebody advise what program would open an image with the file header of 0x00 00 02 00.
Try Gary Kessler's web site with file signatures.
Hi,
Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.
Thanks
Take a look at IrfanView -
Hi,
Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.
Thanks
Yes it is written like that ) , the "trick" is knowing that it is also called "TGA" wink .
http//
It seems like a "DATA TYPE 2 Unmapped RGB"
http//
See if this fits
http//tgaviewer.com/
jaclaz
Take a look at IrfanView -
http//www.irfanview.com/.
ntexaminer,
Thanks this file opened perfectly in Irfanview!
Hi,
Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.
Thanks
Yes it is written like that ) , the "trick" is knowing that it is also called "TGA" wink .
http//
en.wikipedia.org/wiki/Truevision_TGA It seems like a "DATA TYPE 2 Unmapped RGB"
http//www.paulbourke.net/dataformats/tga/ See if this fits
http//tgaviewer.com/jaclaz
Jaclaz,
Thanks for that, I have been looking into the image but I am struggling to get my head around it, as it is not something you come across regularly.
JPEG are pretty straightforward to spot, Header of 0xFF D8 FF E0 and Trailer of 0xFF D9. According to Gary Kessler the TGA file does not have a header but should have a trailer of
0x54 52 55 45 56 49 53 49 4F 4E 2D 58 46 49 4C 45 2E 00 (TRUEVISION-XFILE)
The image I am looking at has a no evidence of this signature or any other signatures that are recognisable.
Thanks
Chris
I have it mapped to a .cur file in my carving routine
I have it mapped to a .cur file in my carving routine[/quote
Mscotgrove,
Sorry, yes this is one of the things that seemed to match the header even though the file extension has been changed. encase doesn't seen to pick this file up as anything out of the ordinary when you conduct a file signature analysis.
Thanks
Chris
What is the rest of the string?
My software matches the string
0x00 0x00 0x02 0x00 0x01 0x20
One problem with the string as you show it, it could just be a big endian length of 0x200, typical sector length. There might be many false positives. The longer the match, the better.
Sometimes, only logic will help, for instance a ZIP file and .DOCX file both start with 'PK'