Hex signature for odt files

Bones_08 · Blue Pill Joined: Mar 14, 2009 Posts: 3

Im trying to retrieve a file that i accidently deleted, and it says that i need a hex signature for it. I have no idea what this is, so if someone could help me out that would be great

James3359 · Posted: Sat Mar 14, 2009 1:22 pm Post subject:

Your file recovery software is looking for the hexadecimal number(s) which are the 'fingerprint' for the type of file you are trying to recover. I'm sorry that I don't know what the hex signature is for the file type you are looking for. I think there is a good chance someone else here does, and hopefully you will get a response.

Bones_08 · Blue Pill Joined: Mar 14, 2009 Posts: 3

Thanks, I hope you're right about somebody being able to help me. I lost all of my history class notes and i really need them if im gonna pass this course

OPENSTEP · Posted: Sat Mar 14, 2009 4:44 pm Post subject:

Does the message refer to "SHA1" or "MD5"? Those are hex "fingerprints" for files, but they can only be computed if the file exists Sad

I don't have much experience with file recovery software myself, so I'm probably not familiar with the term.

ed

sardisson · Town Crier Joined: Feb 01, 2004 Posts: 4588

This one site has two different "hex signatures" listed of OpenDocument .odt files, one and two (it also has some signatures for non-OpenDocument .odt files). No clue what's going on; that's just what Google found.

Do you suppose these are sort of like Magic numbers?

Smokey

James3359 · Posted: Sun Mar 15, 2009 12:42 am Post subject:

From the Oasis site

Bones_08 · Blue Pill Joined: Mar 14, 2009 Posts: 3

so you saying the first 4 characters in the signature are 50 and 4B, i dont understand what you mean by beginning at position 30 you should find the hex characters which represent the word 'mimetype' - 6d 69 6d 65 74 79 70 65, could you explain. It also asks for an offset of signature in file, what does this mean?

James3359 · Posted: Mon Mar 16, 2009 10:24 am Post subject:

OK, I don't know how much I'm going to be able to help you with this because I haven't done it myself. You are obviously using a file recovery package and it would be useful to know which package and to have more detail about what it is asking you to do.

In general principle it works like this. In the normal way when you delete a file all that happens is that your system removes the information on your hard disk which reserves that part of your disk for your file. As a result the system then regards that part of the disk as available for use again. However, until your system chooses to store fresh data in that location your original data remains and may be recoverable.

Data recovery software works by reading all sectors of your hard disk looking for the raw data which matches the beginning of the file for the kind of file you are trying to recover. When it finds this it know it has found the start of a file, and it can then attempt to follow it through to its end. It has a database of 'signatures' for the beginnings of different kinds of files, and it also has a facility for you to tell it what signature your file ought to have.

Hexadecimal numbers have two character representations and run from 00 to FF (equivalent to 0-256 in decimal numbers). For all .odt files the first two hexadecimal numbers are 50 and 4B (representing the ASCII characters PK). This may be enough of a digital signature for your recovery software to find the deleted files.

(The 30th-37th characters in an .odt file spell out in hexadecimal numbers the ASCII word 'mimetype' and are represented by the hexadecimal characters I posted previously.)

Does this help you to understand what the recovery software you are using is trying to do?

Incidentally, because the area on your hard disk where your deleted fileis stored is no longer marked as being reserved, it is important not do do anything which will result in data being saved to the disk and potentially overwriting what you are trying to recover.