hi all,
i've got a question for anyone out there who may have encountered something similar. i am looking at some files which i believe could either possibly be encrypted or renamed. the files currently have .txt extentions however the content is not plaintext. my other theroy is that it is another file type which has just been renamed. i am trying to restore these files for a friends drive but he said his brother didn't have a clue what they were created in but that the file names were important to him.. anyhow anyone have any ideas? i was wondering if anyone could share some good url's for searching in hex file headers or possibly win32 file identification software? again, there is no obvious tagging in the files just that they all start with MWCR.
thx!
Can you copy and paste some of the data into a post, the first few lines of code will do.
Andy
MWCR·····ÖÕw0E··¦·······································································································································································································································································listing_of_a.txt···èÃÕwþ·2·
···!···@µä·········
···Ãä··ë··s_ÔwèÃÕwþ·2·
···!···@µä·····„ì··¿hJ·èÃÕwþ·2·
···!···@µä·„ì··$÷·Ãä·Âì··‚eG·Âì··Ãä·$=J·$÷·Âì··Ãä·çgJ·$÷·Ãä·Ã䷘‚ä·˜‚ä·X˜ä·························T뷷÷6·äë··
9×wh›Ùwÿÿÿÿ3;ÔwõDÔ
Can you copy and paste some of the data into a post, the first few lines of code will do.
Andy
I don't know what this is. It doesn't look like a file header. "ÃÕwþ·2· " seems to feature in the text and so does "···!···@µä" - try downloading WinHEx and taking a look at it in hex. It's possibly encryption but I don't know for sure.
A good site for searching file extensions: -
merci 😀
.txt files wont have a specific header, it's just starts with the text of the file. I can't say that I've seen the header you posted. It may be some type of image format.
.txt files wont have a specific header, it's just starts with the text of the file. I can't say that I've seen the header you posted. It may be some type of image format.
cool thanks! that's what I was thinking as well, it could possibly be an Image file of some sort. Oh well - back to ye ole drawing board.
flytnx,
Do all of the files have the same or similar headings?
I have a Windows CLI-based tool that does file signature analysis, and I don't recognize that format…though, it may be a proprietary binary format of some kind.
H. Carvey
"Windows Forensics and Incident Recovery"