How to find out file types without extension ??

[PowerGod]

Hi, one of my friend gave me a troubling external hard drive, and asked me if I was able to get the data back...

My friend told me that there were folders in there, but the disk gave him trouble and them disappeared.

The things I see in there are some files with impossible filenames (at least for Windows, but I can open them with linux).
One of those files is like 500Mb, and I can't understand what it contains.

Also the only folders I see are some "Found.00<number>" folders full of .CHK files.

So, this is what I did by now:

1) using "file *.CHK --mime-type" I was able to assume the right extensions for the majority of the files

2) most of the others are recognized as "application/octet-stream" so I used "ffmpeg -i <filename>" on them to get info about possible media types and I got some .3gp, .mp3, and .mpg, but most of the files were not recognized as media.

Now I'm pretty stuck for the other files...

Is there some other utility that can recognize what else could be an "application/octet-stream" ?

I got different files as "application/CDFV2" and I can't find info about them.

For the other files in the root (the ones with impossible names), "file" just reports them as "data"... is there something else I could use to find out what them can contain ?

Thanks

 

[Linux-SWAT]

Maybe testdisk/photorec has some magic command.

 

[levi]

CDFV2 appears to be a microsoft format, and could be almost anything from a mailstore to a word document(??) according to an internet search. I dunno what subset of those file can decode; I'd expect it to pick out word documents but I dunno. And once you've decoded what it is, getting an actual three letter extension for it I can't really help with.l

I find it useful sometimes to push things through strings, almost always lessing the output cos there can be quite a lot on a large file.

As far as I can tell, .chk files are data recovered by chkdsk, so this might already have been lost and found data before the drive actually gave up. I assume windows has a way of unpacking those files, but I dunno. It's probably not your problem in any case, unless they came about in the process of the drive falling over.

Sorry, I'm not sure I'm really helping here, but there you go.

 

[jparish1977]

Perhaps you might be able to do something with this: https://en.m.wikipedia.org/wiki/List_of_file_signatures

Sent from my SM-N950U using Tapatalk

 

[PowerGod]

@Linux-SWAT : testdisk/photorec found a lot of things deleted from the drive, and the recovered things have already the right extension, cool

@levi : all the CHK seems to be complete single files, just adding the right extension to them makes them work as normal... for some office/document types I had to try different extension to find the right one

@jparish1977 : cool, I'll try also some hex session then

 

[miner2049er]

The CHK files are created by Windows when you plug a drive in and it says the drive has problems, would you like to repair.

 

[Magic Sam]

Hi all

@PowerGod : we use "siegfried" at work:

https://www.itforarchivists.com/siegfried

Hope that helps !

Cheers, Magic Sam

 

[elvissteinjr]

TrID seems to be a neat fit to what you want to achieve. It can even rename the files for you if you wish.

 

[PowerGod]

Thanks, when testdisk has finished (estimated 20 hours) I'll try them too

For now I see that while photorec recovered even folders (with numbered names), most of the recovered files are corrupt... I used it with default options, maybe I should have chosen to not keep them.

EDIT:

Ok, photorec terminated after 70 hours and just because the disk totally died...

Anyway 250Gb recovered from a 300Gb unreadable HD seems a very good result to me.

90% of the files seems not corrupted, the others present some glitches here and there.

In the end, "file" did the best work in finding filetypes, but TrID and Sigfried found the right extension for 10 other files.

TrID was super useful because it added automatically all the extensions, even if 90% of the renamed files were wrongly recognized (but I still don't know what types are those).

Siegfried gave the same results of TrID, but it returns only a list, like "file" do.

Now I'll just do a comparison between photorec recovered files and all the renamed CHK, to remove dupes, and leave the rest to my friend.

Thanks to all