0x00 00 02 00 Image File

Could somebody advise what program would open an image with the file header of 0x00 00 02 00.

Try Gary Kessler's web site with file signatures.

Hi,

Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.

Thanks

Take a look at IrfanView - http//www.irfanview.com/.

Hi,

Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.

Thanks

Yes it is written like that ) , the "trick" is knowing that it is also called "TGA" wink .

http//en.wikipedia.org/wiki/Truevision_TGA

It seems like a "DATA TYPE 2 Unmapped RGB"
http//www.paulbourke.net/dataformats/tga/

See if this fits
http//tgaviewer.com/

jaclaz

Take a look at IrfanView - http//www.irfanview.com/.

ntexaminer,

Thanks this file opened perfectly in Irfanview!

Hi,

Thanks for the advice, however I have already tried Gary Kessler but he does not have it. I know it is a Targa image file (not sure if this is how it is written) however I'm not sure what program will open it.

Thanks

Yes it is written like that ) , the "trick" is knowing that it is also called "TGA" wink .

http//en.wikipedia.org/wiki/Truevision_TGA

It seems like a "DATA TYPE 2 Unmapped RGB"
http//www.paulbourke.net/dataformats/tga/

See if this fits
http//tgaviewer.com/

jaclaz

Jaclaz,

Thanks for that, I have been looking into the image but I am struggling to get my head around it, as it is not something you come across regularly.

JPEG are pretty straightforward to spot, Header of 0xFF D8 FF E0 and Trailer of 0xFF D9. According to Gary Kessler the TGA file does not have a header but should have a trailer of
0x54 52 55 45 56 49 53 49 4F 4E 2D 58 46 49 4C 45 2E 00 (TRUEVISION-XFILE)

The image I am looking at has a no evidence of this signature or any other signatures that are recognisable.

Thanks
Chris

I have it mapped to a .cur file in my carving routine

I have it mapped to a .cur file in my carving routine[/quote

Mscotgrove,

Sorry, yes this is one of the things that seemed to match the header even though the file extension has been changed. encase doesn't seen to pick this file up as anything out of the ordinary when you conduct a file signature analysis.

Thanks
Chris

What is the rest of the string?

My software matches the string

0x00 0x00 0x02 0x00 0x01 0x20

One problem with the string as you show it, it could just be a big endian length of 0x200, typical sector length. There might be many false positives. The longer the match, the better.

Sometimes, only logic will help, for instance a ZIP file and .DOCX file both start with 'PK'