SigFind

Description

sigfind searches through a file and looks for the hex_signature at a given offset. This can be used to search for lost boot sectors, superblocks, and partition tables.separate file.

Usage

Syntax

sigfind [-b bsize] [-o offset] [-t template] [-lV] [hex_signature] file

Options

        -b bsize: Give block size (default 512)
	-o offset: Give offset into block where signature should exist (default 0)
	-l: Signature will be little endian in image
	-V: Version
	-t template: The name of a data structure template:
		dospart, ext2, ext3, fat, hfs, hfs+, ntfs, ufs1, ufs2

Example

cyborg@cyborg:~$ sudo sigfind -o 510 -l AA55 image.dd 
Block size: 512  Offset: 510  Signature: 55AA
Block: 0 (-)
Block: 336 (+336)
Block: 15538 (+15202)
Block: 15539 (+1)
Block: 15540 (+1)
Block: 15541 (+1)
Block: 15551 (+10)
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?