Hi.
I am trying to do some File Carving to retrieve lost OO.o data files
from a hard drive.
I have done a google search, but either am searching for the wrong
thing, or what I am after isn't available.
What I am after, is the digital signature of the OO.o file types -
specifically ver. 1.0.x etc, e.g. *.sxc/*.sxw.
The data recovery program I am using uses these signatures to identify
and extract the file from the drive.
An example of the signature for a JPEG (this came with the program) file
is as follows:
"
# GIF and JPG files (very common)
gif y 155000000 \x47\x49\x46\x38\x37\x61
\x00\x3b
gif y 155000000 \x47\x49\x46\x38\x39\x61
\x00\x00 \x3b
jpg y 200000000 \xff\xd8\xff\xe0\x00\x10
\xff\xd9
#
# PNG (used in web pages)
png y 200000 \x50\x4e\x47? \xff\xfc\xfd\xfe
#
"
The program I am using for this is 'Foremost'.
http://foremost.sourceforge.net/
OK - I just found this link - of note is the *.zip output:
"
*zip* Note is will extract .jar files as well because they use
a similar format. Open Office docs are just zipâEUR^(TM)d XML
files so they are extracted as well. These include SXW,
SXC, SXI, and SX? for undetermined OpenOffice files.
"
http://foremost.sourceforge.net/foremost.html
RTFM - DOH!! :-)
Hmmm... maybe I'll just go check the output *.zip files I already have
extracted...
Cheers,
Elroy.
