Can someone ask the EU to mandate that all file formats are described publicly so I don't have to do this, as fun as it is?
#ReverseEngineering Start of ADI file format:
Spent way too long chasing compressed data that was actually Unicode. All strings written by the application are unicode.
Header BIFH
Trailer BIFT
Bytes between 10h and 2Fh change dramatically per file
Drive ID at 3984789 [3CCD95h] probably depends on length of file but needs more investigation because it might be a *destination* drive ID
Comment at 3984432 [3CCC30h]
Filename / Backup name at 44h
Data is going to take a lot more work but if you have UNCOMPRESSED ADI files (not the default!) you MAY be able to carve your data straight out of the file.
If the backup is compressed, it's zlib.
Adam ♿ /
npub1lg…463y5
2024-09-08 05:44:45
in reply to nevent1q…2gfr
Author Public Key
npub1lgde6qaf62rqpfhrmpg492rlz0c2qvt35fan5j0n78yf4qnc8yjq7463y5Published at
2024-09-08 05:44:45Event JSON
{
"id": "9f402be1d13961cd271313304dcc6011b21def45e717026bdca5b0eb59f1a0fd",
"pubkey": "fa1b9d03a9d28600a6e3d85152a87f13f0a03171a27b3a49f3f1c89a82783924",
"created_at": 1725774285,
"kind": 1,
"tags": [
[
"e",
"6c127eb1eb0db0d39892da55de0e073d8674e1baba82ea85aaeb1c66c1935fea",
"",
"reply",
"fa1b9d03a9d28600a6e3d85152a87f13f0a03171a27b3a49f3f1c89a82783924"
],
[
"e",
"97460f83d16074925471803b457f10b2be83ac2a3e0397f8e9b87bd6714eb865",
"",
"root",
"fa1b9d03a9d28600a6e3d85152a87f13f0a03171a27b3a49f3f1c89a82783924"
],
[
"p",
"fa1b9d03a9d28600a6e3d85152a87f13f0a03171a27b3a49f3f1c89a82783924"
],
[
"proxy",
"https://aus.social/@voltagex/113100343586152891",
"web"
],
[
"t",
"reverseengineering"
],
[
"proxy",
"https://aus.social/users/voltagex/statuses/113100343586152891",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://aus.social/users/voltagex/statuses/113100343586152891",
"pink.momostr"
],
[
"-"
]
],
"content": "Can someone ask the EU to mandate that all file formats are described publicly so I don't have to do this, as fun as it is?\n\n#ReverseEngineering Start of ADI file format:\n\nSpent way too long chasing compressed data that was actually Unicode. All strings written by the application are unicode.\n\nHeader BIFH\nTrailer BIFT\n\nBytes between 10h and 2Fh change dramatically per file\n\nDrive ID at 3984789 [3CCD95h] probably depends on length of file but needs more investigation because it might be a *destination* drive ID\n\nComment at 3984432 [3CCC30h]\nFilename / Backup name at 44h\n\nData is going to take a lot more work but if you have UNCOMPRESSED ADI files (not the default!) you MAY be able to carve your data straight out of the file.\n\nIf the backup is compressed, it's zlib.",
"sig": "fe1a84227579f393547e4207bb24c7a91d2025a8b4ae1f74c2765adcabbb01d8f54505e081ee09338bae3b9f61f5f12243c0b8bcc2d3f88d7f42dd42d6b90742"
}