GetDataBack for NTFS 新版新功能

freesoft00 · 发表于 2008-12-15 02:46:36

GetDataBack for NTFS
GetDataBack for FAT

最新的额版本3.6.4.0中增加了一个gdbnt.ini文件，类似于winhex中的File Type Signatures.txt文件的作用。通过文件头来恢复文件。
这个文件的格式是这样的

[LOSTFILES]
;Define here any files you want to show up in the "Lost files" branch of the recovery tree
;You must provide a file signature between 2 and 8 byte length, located at the beginning of the file
;Also provide an expression determining the size of the file. You can reference any byte of the
;file's first sector.
;Example: Help-Files
;  Help files start with the signature $3F,$5F,$03,$00.
;  Found lost Help files will get the extention HLP in the recovery tree
;  The size will be determined by the double word found at position 12 in the first sector [12,4]
;NOTE:
;  Many files types, e.g. ZIP-files, do not contain their length in their header. However, you can
;  specify a length large enough to cover the size of the ZIPs you want to recover. Many applications
;  (such as WINZIP) are not bothered by files that are longer than in their original state.
;NAME    EXT SIGLENGTH SIG             TYPE SIZEEXP
;Winword1= DOC,4,       $9b,$a5,$21,$00, 1, [32,4]
Winword1= DOC,4,       $9b,$a5,$21,$00, 1, 100000
;Winword2= DOC,4,       $db,$a5,$2d,$00, 1, [32,4]
Winword2= DOC,4,       $db,$a5,$2d,$00, 1, 100000
Winword6= DOC,4,       $d0,$cf,$11,$e0, 1, [$2c,1]*65536+512
Help-File=  HLP,4,       $3F,$5F,$03,$00, 1, [12,4]
RIFF-File=  WAV,4,       $52,$49,$46,$46, 1, [4,4]+8
WMF-File= WMF,6,       $D7,$CD,$C6,$9A,$00,$00, 1,  [$1c,4]*2+24
ZIP-File= ZIP,4,       $50,$4B,$03,$04, 1, 100000
JPG-File= JPG,3,       $FF,$D8,$FF,    10, 5000000
AVI-File= AVI,4,       $52,$49,$46,$46, 1, [4,4]
MP3-File= MP3,3,       $49,$44,$33,    11,  10000000
BMP-File= BMP,2,       $42,$4d,          12, [2,4]

请问如何自己把winhex中File Type Signatures.txt的现成格式变成gdbnt.ini文件，我只知道NAME ext 和siglength如何填写，至于后面对额TYPE SIZEEXP该如何填写。和File Type Signatures.txt中部太一样。

软件可以在www.greendown.cn绿色软件园下载，在网站上自己搜索就可以了