Customizing File Types-I

Top  Previous  Next

The syntax of signature description is similar to that of the XML language. They are stored in an .xml file the path to which is specified on the Setting dialog box.

More advanced features are described in Customizing File Types-II.

Signature file example

<?xml version="1.0" encoding="utf-8"?>

<FileTypeList>

   <!-- Search for NTFS MFT -->

   <FileType id="5626" group="System Files" description="MFT" features="TXT_ANSI TXT_UNICODE">

      <Signature offset="0" from="begin" count="1">FILE</Signature>

      <Signature offset="7" from="end" count="1">$\x00M\x00F\x00T</Signature>

   </FileType>

</FileTypeList>

File structure

File header

The file starts with a standard  XML header

<?xml version="1.0" encoding="utf-8"?>

Section FileTypeList

<FileTypeList>

It requires a closing element </FileTypeList>.

Section FileType

This is a description of each file signature.

Attributes:

id

<u32>

Required

Digital file type identifier. Should be unique for each file type.


group

<string>

Optional

Specifies a file type group in which found files will appear. You may specify either your own groups or those predefined on the File Types dialog box.

Default: unknown

description

<string>

Optional

Brief file description

Default: null (no description)

features

NO_SCAN

TXT_ANSI

TXT_UNICODE

Optional

Additional properties of the file type. If you want to specify several properties, they should be separated by a space.

Default: 0

extension

<string>

Optional

File extension.

Default: null (no extension)

File type properties flags

NO_SCAN

Not to be scanned for. If this flag is used, R-Studio will not search for such file type. Such files will be shown when sorting files by their extensions.

TXT_ANSI

The file can viewed as ANSI text. If this flag is specified, the file can be correctly represented as an ANSI text. When previewing, this file will be immediately sent to Text/Hexadecimal Editor.

TXT_UNICODE

File can viewed as UNICODE text. If this flag is specified, the file can be correctly represented as a UNICODE text. When previewing, this file will be immediately sent to Text/Hexadecimal Editor.

This section can contain an unlimited number of the Signature elements.If there are several Signature elements, that means that all those signatures are simultaneously present in the file. Such signatures should have different offset attributes and they should not overlap.

Element Signature

The element contains a string value of the file signature consisting of ASCII characters and hex bytes in the \xhh format, where hh is a hexadecimal byte code. If there is not a hexadecimal number after \x , \x are treated as a part of the string section of the signature

Attributes:

offset

<u16>

Optional

Decimal offset for the signature

Default: 0

count

<u16>

Optional

Decimal number specifying the number of signatures of the same length. Used when several signatures of the same length starting with the same offset can be present in a file. In this case they should be sequentially written in the element, and the size attribute specifies the length of signature. count*size should be equal to the number of bytes in the element.

If only one signature can be on this offset, count should be equal "1", and size should be equal to the length (the number of bytes) of the signature.

Default: 1

size

<u16>

Optional

Decimal number specifying the number of bytes in the signature.

Default: the number of bytes written in the element.

from

begin

end

Optional

Specifies from where the offset is calculated.

If end, the offset is from the end of file to the first byte of the signature. That is, if the signature is two bytes long, the offset value should be 2.

Default: begin

Comments

<!-- Comment string -->

An XML standard string for a comment.