Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
543
Views
Topic starter
24/11/2010 3:44 pm
Hi,
I use X-Ways for recovering data but recently using a version that does not have MP3 in the file signatures (this is for testing purposes).
Now I have used the expression ID3[\x02-\x04]\x00[\x00\x80]\x00 that is given in the newer X-Ways file signature and placed it into the 'File Type Signatures Search' but once this has been entered into the signature list it says the "Expression is too long" when trying to recover the data.
Does anyone know how I can get around this or any other expressions to use that will work?
Thanks in advance
24/11/2010 6:50 pm
I do not know X-Ways but you have two types of expression
[\x02-\x04]
and
[\x00\x80]
Should there be a '-' in the second one
I presume it is for a range