Join Us!

MP3 File Signature ...
 
Notifications
Clear all

MP3 File Signature for X-Ways Help Please  

  RSS
forensicgeek
(@forensicgeek)
New Member

Hi,

I use X-Ways for recovering data but recently using a version that does not have MP3 in the file signatures (this is for testing purposes).

Now I have used the expression ID3[\x02-\x04]\x00[\x00\x80]\x00 that is given in the newer X-Ways file signature and placed it into the 'File Type Signatures Search' but once this has been entered into the signature list it says the "Expression is too long" when trying to recover the data.

Does anyone know how I can get around this or any other expressions to use that will work?

Thanks in advance

Quote
Posted : 24/11/2010 2:44 pm
mscotgrove
(@mscotgrove)
Senior Member

I do not know X-Ways but you have two types of expression

[\x02-\x04]

and

[\x00\x80]

Should there be a '-' in the second one

I presume it is for a range

ReplyQuote
Posted : 24/11/2010 5:50 pm
Share: