TestDisk & PhotoRec 7.1

This commit is contained in:
Christophe Grenier 2019-07-07 17:25:03 +02:00
parent ede2a1beb8
commit 3bb714e653
9 changed files with 74 additions and 24 deletions

2
INFO
View file

@ -1,2 +1,2 @@
TestDisk & PhotoRec , https://www.cgsecurity.org TestDisk & PhotoRec , https://www.cgsecurity.org
Copyright (C) 1998-2018 Christophe GRENIER <grenier@cgsecurity.org> Copyright (C) 1998-2019 Christophe GRENIER <grenier@cgsecurity.org>

66
NEWS
View file

@ -1,5 +1,43 @@
Current news Current news
== 7.1-WIP == == 7.1 ==
== General Improvements ==
* It should be possible to reproduce, byte for byte, every build of testdisk package in Debian https://wiki.debian.org/ReproducibleBuilds
* Windows: Identify again the device model (Regression present in 7.0 version)
== TestDisk ==
=== Improvements ===
* Ask confirmation when user quits the list of partitions found by TestDisk
=== Bug fixes ===
* Various fix for Scripted run
== PhotoRec & QPhotoRec ==
=== Improvements ===
* Log the correct filenames in photorec.log file
* Reduced false positives for tar
* Fix recovery of mobius camera videos.
* Fix recovery of progressive jpeg
* Extract the filesize from sqlite header when available
* Recover more fragmented files
Extract of the new file formats recovered by PhotoRec:
* .aes: Synology AES key files
* .axp: Pinnacle Studio
* .bdm: AVHCD index
* .cpi: AVCHD Clip Information
* .DS_Store: Apple Desktop Services Store
* .dvr: RT60
* .gi: Roxio Creator
* .gpx: Guitar Pro 6
* .gp4: Guitar Pro 4
* .iam/.ipt Autodesk Inventor part
* .icns: Apple Icon Image
* .jsonlz4: Mozilla bookmarks
* .lyx LyX 2.X
* .mpl: AVHCD playlist
* .tg Tux Guitar 1.2
* .vdj: VirtualDJ
* .wee: weecast
* .xar: XAR Archive
== 7.0 == == 7.0 ==
@ -98,14 +136,14 @@ New file formats:
== 6.13 == == 6.13 ==
Fix UAC manifests for Windows, so users don't need to use right-click "Run As Administrator" Fix UAC manifests for Windows, so users don't need to use right-click "Run As Administrator"
TestDisk TestDisk
- Fix image creation, image.dd file wasn't created (Regression introduced in 6.12) - Fix image creation, image.dd file wasn't created (Regression introduced in 6.12)
- Detect Vmware VMFS partition - Detect Vmware VMFS partition
- Locate lost GFS2 partition but not yet the size - Locate lost GFS2 partition but not yet the size
- Log HDD serial number and firmware revision - Log HDD serial number and firmware revision
- List NTFS Alternate Data Streams (ADS) - List NTFS Alternate Data Streams (ADS)
PhotoRec PhotoRec
- Session recovery restarts at the previous location - Session recovery restarts at the previous location
@ -113,13 +151,13 @@ PhotoRec
- Better JPG recovery, there should be less cases where thumbnails were recovered instead of the picture itself. - Better JPG recovery, there should be less cases where thumbnails were recovered instead of the picture itself.
- Handle large avi files using "AVIX" or mov files using 64-bit chunk size. - Handle large avi files using "AVIX" or mov files using 64-bit chunk size.
- Rename recovered pdf using the title (not perfect) - Rename recovered pdf using the title (not perfect)
- Major cleanup of PhotoRec core code - Major cleanup of PhotoRec core code
6.12 6.12
fidentify, a little utility sharing PhotoRec signature database, is now build by default. It identifies the type of data contained in a file and reports the extension as seen by PhotoRec. It is similar to the Unix file command. Add compatibility with fidentify, a little utility sharing PhotoRec signature database, is now build by default. It identifies the type of data contained in a file and reports the extension as seen by PhotoRec. It is similar to the Unix file command. Add compatibility with
- libewf 20110312 - libewf 20110312
- ncurses 5.8 - ncurses 5.8
- ntfs-3g - ntfs-3g
Fix detection of Encase 6 .ewf files Fix detection of Encase 6 .ewf files
TestDisk TestDisk
@ -127,14 +165,14 @@ TestDisk
- Better HPA/DCO detection: handle the case where native_max is null. - Better HPA/DCO detection: handle the case where native_max is null.
- Image Creation is now faster than previous version when there are bad sectors - Image Creation is now faster than previous version when there are bad sectors
- List and copy (experimental) files from exFAT filesystem - List and copy (experimental) files from exFAT filesystem
- Improved NTFS undelete interface - Improved NTFS undelete interface
PhotoRec PhotoRec
- PhotoRec checks for EFBIG (file too large) error when writing files. It's usefull to avoid erronous message about "no free space available" when recovering to a FAT filesystem. - PhotoRec checks for EFBIG (file too large) error when writing files. It's usefull to avoid erronous message about "no free space available" when recovering to a FAT filesystem.
- Recover files from exFAT unallocated space - Recover files from exFAT unallocated space
- Use doc/xls/ppt title to name recovered Office document, use first filename in zip archive... - Use doc/xls/ppt title to name recovered Office document, use first filename in zip archive...
- Possibility to add your own extension/custom signature to PhotoRec - Possibility to add your own extension/custom signature to PhotoRec
- Generated a report.xml file using Digital Forensics XML - Generated a report.xml file using Digital Forensics XML
6.11 6.11
TestDisk & PhotoRec 6.11 should use less CPU. TestDisk & PhotoRec 6.11 should use less CPU.
@ -174,7 +212,7 @@ MacBook and Mac Pro.
be enabled for at least MacOSX, so users won't have to go into a command line. be enabled for at least MacOSX, so users won't have to go into a command line.
- Improved Windows disk support, most internal USB card reader should now work. - Improved Windows disk support, most internal USB card reader should now work.
- Disk model (ie. ATA ST3120026AS, _NEC DVD_RW ND-4550A...) are now reported - Disk model (ie. ATA ST3120026AS, _NEC DVD_RW ND-4550A...) are now reported
under Linux. under Linux.
TestDisk TestDisk
- New file system support has been added: encrypted LUKS, Mac HFSX, Linux Raid - New file system support has been added: encrypted LUKS, Mac HFSX, Linux Raid
@ -243,13 +281,13 @@ InDesign .indd, Matroska .mkv, MP3 with ID3 header, MS cabinet archive
.cab, MSOffice "Open" XML .docx, .pptx, .xlsx, MS executable (PE), MS .cab, MSOffice "Open" XML .docx, .pptx, .xlsx, MS executable (PE), MS
Windows Metafile .wmf, NJStar .njx, Quickbooks .qbb and .qbw, Real Audio Windows Metafile .wmf, NJStar .njx, Quickbooks .qbb and .qbw, Real Audio
.rm, registry config file .reg, RPM package .rpm, Windows registry header .rm, registry config file .reg, RPM package .rpm, Windows registry header
detection and Event Log .evt detection and Event Log .evt
6.6 6.6
General Improvements General Improvements
- Encase Expert Witness Compression Format is now supported, so Computer - Encase Expert Witness Compression Format is now supported, so Computer
Forensic Experts can use TestDisk and PhotoRec more easily. Forensic Experts can use TestDisk and PhotoRec more easily.
- Under new Vista OS, harddisks are now being reported again. - Under new Vista OS, harddisks are now being reported again.
TestDisk TestDisk
- If LBA48 support seems missing (HD bigger than 130 GB not supported by - If LBA48 support seems missing (HD bigger than 130 GB not supported by
the OS), TestDisk will warn the user. This problem is common when a user the OS), TestDisk will warn the user. This problem is common when a user
@ -258,7 +296,7 @@ reinstalls his OS and forgets to install the latest service patches.
some filesystem corruption has occurred; more importantly, it will allow some filesystem corruption has occurred; more importantly, it will allow
the user to copy whatever file data it can as well. the user to copy whatever file data it can as well.
- FAT: Improved heuristics to find the first FAT area during boot sector - FAT: Improved heuristics to find the first FAT area during boot sector
rebuild. rebuild.
PhotoRec PhotoRec
- A new method for handling fragmented data is now used, making recovery - A new method for handling fragmented data is now used, making recovery
more reliable and faster. more reliable and faster.
@ -269,7 +307,7 @@ efficient.
- New file formats have been added: .3g2 (Mov video family), .aif Apple - New file formats have been added: .3g2 (Mov video family), .aif Apple
Audio, .all .cpr Cubase Song, .blend Blender, .cam Casio QV Digital Camera Audio, .all .cpr Cubase Song, .blend Blender, .cam Casio QV Digital Camera
Image, .flac Free Lossless Audio Codec, .mdf Microsoft SQL, .swf Image, .flac Free Lossless Audio Codec, .mdf Microsoft SQL, .swf
Macromedia Flash and .vcf VCard (not confused with .txt anymore) Macromedia Flash and .vcf VCard (not confused with .txt anymore)
6.5 6.5
TestDisk TestDisk
@ -282,7 +320,7 @@ partition to a selected directory.
PhotoRec PhotoRec
- New file formats have been added: AppleWorks .cwk, DIF Digital Video .dv, - New file formats have been added: AppleWorks .cwk, DIF Digital Video .dv,
DjVu .djv, Finale .mus, Incredimail .imm, .imb, iTunes mhbd, MIDI .mid, DjVu .djv, Finale .mus, Incredimail .imm, .imb, iTunes mhbd, MIDI .mid,
MS Backup, Real Media .rm & .ram, Reason .rns, ruby .rb, .xml MS Backup, Real Media .rm & .ram, Reason .rns, ruby .rb, .xml
- File size detection for .bmp, .pdf, .gif, Office document has been improved. - File size detection for .bmp, .pdf, .gif, Office document has been improved.
- A endless loop bug and a memory leak have been fixed. - A endless loop bug and a memory leak have been fixed.
- The I/O cache engine now caches read failure, it will speedup some recovery. - The I/O cache engine now caches read failure, it will speedup some recovery.
@ -430,7 +468,7 @@ New features:
- can rebuild NTFS boot sector - can rebuild NTFS boot sector
- can recover JFS partition - can recover JFS partition
- some advanced FAT32 functions have been added (Expert mode only) - some advanced FAT32 functions have been added (Expert mode only)
Improvements: Improvements:
- Can align partition to cylinder boundary or to head boundary. - Can align partition to cylinder boundary or to head boundary.
- Doesn't abort while writing partitions if read failed. - Doesn't abort while writing partitions if read failed.

View file

@ -57,10 +57,16 @@ case "$crosscompile_target" in
VER_NTFSPROGS= VER_NTFSPROGS=
VER_E2FSPROGS="1.42.8" VER_E2FSPROGS="1.42.8"
;; ;;
arm-none-linux-gnueabi|powerpc-linux-gnuspe)
VER_LIBNTFS3G="2014.2.15"
VER_NTFSPROGS=
VER_E2FSPROGS="1.42.8"
;;
*) *)
VER_LIBNTFS3G="2014.2.15" VER_LIBNTFS3G="2014.2.15"
VER_NTFSPROGS= VER_NTFSPROGS=
VER_E2FSPROGS="1.42.8" VER_E2FSPROGS="1.42.8"
VER_LIBEWF=
;; ;;
esac esac
prefix=/usr/$crosscompile_target prefix=/usr/$crosscompile_target

View file

@ -2,11 +2,11 @@
# Process this file with autoconf to produce a configure script. # Process this file with autoconf to produce a configure script.
AC_PREREQ([2.59]) AC_PREREQ([2.59])
AC_INIT([testdisk],[7.1-WIP],[grenier@cgsecurity.org]) AC_INIT([testdisk],[7.1],[grenier@cgsecurity.org])
AC_LANG(C) AC_LANG(C)
sinclude(acx_pthread.m4) sinclude(acx_pthread.m4)
sinclude(mkdir.m4) sinclude(mkdir.m4)
TESTDISKDATE="May 2019" TESTDISKDATE="July 2019"
AC_SUBST(TESTDISKDATE) AC_SUBST(TESTDISKDATE)
AC_DEFINE_UNQUOTED([TESTDISKDATE],"$TESTDISKDATE",[Date of release]) AC_DEFINE_UNQUOTED([TESTDISKDATE],"$TESTDISKDATE",[Date of release])
AC_CONFIG_AUX_DIR(config) AC_CONFIG_AUX_DIR(config)

View file

@ -1,5 +1,8 @@
%{?cygwin_package_header} %{?cygwin_package_header}
#% define is_wip 1
%{?is_wip:%define ver_wip -WIP}
Name: cygwin-testdisk Name: cygwin-testdisk
Version: 7.1 Version: 7.1
Release: 0%{?dist} Release: 0%{?dist}
@ -10,7 +13,7 @@ Summary(ru_RU.UTF8): Программа для проверки и восста
License: GPLv2+ License: GPLv2+
Group: Applications/System Group: Applications/System
URL: https://www.cgsecurity.org/wiki/TestDisk URL: https://www.cgsecurity.org/wiki/TestDisk
Source0: https://www.cgsecurity.org/testdisk-%{version}.tar.bz2 Source0: https://www.cgsecurity.org/testdisk-%{version}%{?ver_wip}.tar.bz2
BuildArch: noarch BuildArch: noarch
BuildRequires: libtool autoconf automake BuildRequires: libtool autoconf automake
@ -111,7 +114,7 @@ PhotoRec is a signature based file recovery utility. It handles more than
%{?cygwin_debug_package} %{?cygwin_debug_package}
%prep %prep
%setup -q -n cygwin-testdisk-%{version} %setup -q -n testdisk-%{version}%{?ver_wip}
%build %build
autoreconf -vif -I config -W all autoreconf -vif -I config -W all

View file

@ -1,5 +1,8 @@
%{?mingw_package_header} %{?mingw_package_header}
#% define is_wip 1
%{?is_wip:%define ver_wip -WIP}
Name: mingw-testdisk Name: mingw-testdisk
Version: 7.1 Version: 7.1
Release: 0%{?dist} Release: 0%{?dist}
@ -10,7 +13,7 @@ Summary(ru_RU.UTF8): Программа для проверки и восста
License: GPLv2+ License: GPLv2+
Group: Applications/System Group: Applications/System
URL: https://www.cgsecurity.org/wiki/TestDisk URL: https://www.cgsecurity.org/wiki/TestDisk
Source0: https://www.cgsecurity.org/testdisk-%{version}.tar.bz2 Source0: https://www.cgsecurity.org/testdisk-%{version}%{?ver_wip}.tar.bz2
BuildArch: noarch BuildArch: noarch
BuildRequires: libtool autoconf automake BuildRequires: libtool autoconf automake
@ -116,7 +119,7 @@ PhotoRec is a signature based file recovery utility. It handles more than
%{?mingw_debug_package} %{?mingw_debug_package}
%prep %prep
%setup -q -n mingw-testdisk-%{version} %setup -q -n testdisk-%{version}%{?ver_wip}
%build %build
autoreconf -vif -I config -W all autoreconf -vif -I config -W all

View file

@ -22,7 +22,7 @@ BEGIN
VALUE "Comments", "Signature based file recovery utility" VALUE "Comments", "Signature based file recovery utility"
VALUE "FileVersion", "7.1" VALUE "FileVersion", "7.1"
VALUE "ProductVersion", "7.1" VALUE "ProductVersion", "7.1"
VALUE "LegalCopyright", "Copyright (C) 1998-2015 Christophe GRENIER, et al." VALUE "LegalCopyright", "Copyright (C) 1998-2019 Christophe GRENIER, et al."
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"

View file

@ -22,7 +22,7 @@ BEGIN
VALUE "Comments", "Signature based file recovery utility" VALUE "Comments", "Signature based file recovery utility"
VALUE "FileVersion", "7.1" VALUE "FileVersion", "7.1"
VALUE "ProductVersion", "7.1" VALUE "ProductVersion", "7.1"
VALUE "LegalCopyright", "Copyright (C) 1998-2015 Christophe GRENIER, et al." VALUE "LegalCopyright", "Copyright (C) 1998-2019 Christophe GRENIER, et al."
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"

View file

@ -22,7 +22,7 @@ BEGIN
VALUE "Comments", "Partition and file recovery utility" VALUE "Comments", "Partition and file recovery utility"
VALUE "FileVersion", "7.1" VALUE "FileVersion", "7.1"
VALUE "ProductVersion", "7.1" VALUE "ProductVersion", "7.1"
VALUE "LegalCopyright", "Copyright (C) 1998-2015 Christophe GRENIER, et al." VALUE "LegalCopyright", "Copyright (C) 1998-2019 Christophe GRENIER, et al."
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"