On 09/25/2013 06:18 AM, Robert J. Hansen wrote:
I'm working on adding support for GnuPG keyrings to a file carver (a
forensic tool that recovers data from damaged filesystems, or recovers
things that have been deleted but not overwritten). Detecting an
ASCII-armored keyblock is pretty easy: look for the "BEGIN PGP PUBLIC"
header. Binary, though, is still an unsolved question.
Before I start diving into code to find out if the keyring has a
specific binary header I can detect, I figured I'd ask on-list. :)
Does anyone know of any magic numbers for GnuPG keyring files?
It would seem that they do exist:
file secring.gpg
secring.gpg: PGP key security ring
The folks that maintain the file(1) program used by most free Unices are
really good about maintaining that information, and sharing it. I don't
have all the details to hand atm, but it shouldn't take too much
searching to find it. If you can't find any other handy repos to dig
through http://svnweb.freebsd.org/base/head/contrib/file/ should get you
on your way.
hth,
Doug
_______________________________________________
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users
