How to find out file types without extension ??

Discussion in 'Offtopic Discussions' started by PowerGod, Jan 28, 2019.

  1. PowerGod

    PowerGod Advanced Member

    Joined:
    Jun 20, 2011
    Messages:
    2,885
    Hi, one of my friend gave me a troubling external hard drive, and asked me if I was able to get the data back...

    My friend told me that there were folders in there, but the disk gave him trouble and them disappeared.

    The things I see in there are some files with impossible filenames (at least for Windows, but I can open them with linux).
    One of those files is like 500Mb, and I can't understand what it contains.

    Also the only folders I see are some "Found.00<number>" folders full of .CHK files.

    So, this is what I did by now:

    1) using " file *.CHK --mime-type" I was able to assume the right extensions for the majority of the files

    2) most of the others are recognized as "application/octet-stream" so I used " ffmpeg -i <filename>" on them to get info about possible media types and I got some .3gp, .mp3, and .mpg, but most of the files were not recognized as media.

    Now I'm pretty stuck for the other files...

    Is there some other utility that can recognize what else could be an "application/octet-stream" ?

    I got different files as "application/CDFV2" and I can't find info about them.

    For the other files in the root (the ones with impossible names), "file" just reports them as "data"... is there something else I could use to find out what them can contain ?

    Thanks
     
  2. Linux-SWAT

    Linux-SWAT Hardcore Member

    Joined:
    Feb 13, 2010
    Messages:
    8,139
    Maybe testdisk/photorec has some magic command.
     
  3. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    10,575
    Location:
    Somewhere off the coast of the EU
    CDFV2 appears to be a microsoft format, and could be almost anything from a mailstore to a word document(??) according to an internet search. I dunno what subset of those file can decode; I'd expect it to pick out word documents but I dunno. And once you've decoded what it is, getting an actual three letter extension for it I can't really help with.l

    I find it useful sometimes to push things through strings, almost always lessing the output cos there can be quite a lot on a large file.

    As far as I can tell, .chk files are data recovered by chkdsk, so this might already have been lost and found data before the drive actually gave up. I assume windows has a way of unpacking those files, but I dunno. It's probably not your problem in any case, unless they came about in the process of the drive falling over.

    Sorry, I'm not sure I'm really helping here, but there you go.
     
  4. jparish1977

    jparish1977 Member

    Joined:
    Oct 1, 2016
    Messages:
    76
  5. PowerGod

    PowerGod Advanced Member

    Joined:
    Jun 20, 2011
    Messages:
    2,885
    @Linux-SWAT : testdisk/photorec found a lot of things deleted from the drive, and the recovered things have already the right extension, cool

    @levi : all the CHK seems to be complete single files, just adding the right extension to them makes them work as normal... for some office/document types I had to try different extension to find the right one

    @jparish1977 : cool, I'll try also some hex session then
     
  6. miner2049er

    miner2049er Still Fresh

    Joined:
    Jul 21, 2016
    Messages:
    13
    The CHK files are created by Windows when you plug a drive in and it says the drive has problems, would you like to repair.
     
  7. Magic Sam

    Magic Sam Forever Homebrew

    Joined:
    Aug 10, 2007
    Messages:
    2,177
    Location:
    Innsmouth, MA
    FBnil likes this.
  8. elvissteinjr

    elvissteinjr Very Active Member

    Joined:
    Aug 23, 2013
    Messages:
    398
    Location:
    Germany
    TrID seems to be a neat fit to what you want to achieve. It can even rename the files for you if you wish.
     
    FBnil likes this.
  9. PowerGod

    PowerGod Advanced Member

    Joined:
    Jun 20, 2011
    Messages:
    2,885
    Thanks, when testdisk has finished (estimated 20 hours) I'll try them too

    For now I see that while photorec recovered even folders (with numbered names), most of the recovered files are corrupt... I used it with default options, maybe I should have chosen to not keep them.

    EDIT:

    Ok, photorec terminated after 70 hours and just because the disk totally died...

    Anyway 250Gb recovered from a 300Gb unreadable HD seems a very good result to me.

    90% of the files seems not corrupted, the others present some glitches here and there.

    In the end, "file" did the best work in finding filetypes, but TrID and Sigfried found the right extension for 10 other files.

    TrID was super useful because it added automatically all the extensions, even if 90% of the renamed files were wrongly recognized (but I still don't know what types are those).

    Siegfried gave the same results of TrID, but it returns only a list, like "file" do.

    Now I'll just do a comparison between photorec recovered files and all the renamed CHK, to remove dupes, and leave the rest to my friend.

    Thanks to all :)
     
    Last edited: Jan 31, 2019

Share This Page

Loading...