From owner-freebsd-questions@FreeBSD.ORG Sat Jun 19 03:34:30 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2C2ED16A4CE for ; Sat, 19 Jun 2004 03:34:30 +0000 (GMT) Received: from ssigc.net (dsl092-076-115.bos1.dsl.speakeasy.net [66.92.76.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8611143D48 for ; Sat, 19 Jun 2004 03:34:29 +0000 (GMT) (envelope-from info@mvcg.net) Received: from ssigc.net (localhost [10.10.10.13] (may be forged)) by ssigc.net (8.12.11/8.12.10) with ESMTP id i5J3a6sM033894 for ; Fri, 18 Jun 2004 23:36:06 -0400 (EDT) Received: from NEON-DURON ([10.10.10.11]) by ssigc.net (MailMonitor for SMTP v1.2.2 ) ; Fri, 18 Jun 2004 23:36:05 -0400 (EDT) Message-ID: <002001c455ae$8d16ab00$0b0a0a0a@neonduron> From: "Thomas Farrell" To: Date: Fri, 18 Jun 2004 23:36:04 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Subject: how to extract 512 bytes from a file X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 19 Jun 2004 03:34:30 -0000 I am trying to recover some files which were on a windowz system, which crashed go figure so someone wiped out the drive format and then relized that they had important files on the drive. They then used sometype of recovery software to extract them and now I have them. These files are supposed to be AVI format but when I open them in a hex editor and extract sections they are not part of an AVI file. It looks like the recovery software just read entire sectors and called them an avi file. I can clearly see the html of cached web pages, and pointers to applications. I do have some files that seem to be almost intact and in the correct format but the header preamble of the file is missing . I was thinking I could take a working avi and extract the first 512 bytes and insert it into the beginning of a bogus file. Does anyone think this may work ? Any idea how I can accomplish this ? I have tried with my hex editor extracting the first 512 bytes to a file like 1st512 and then "cat corruptfile >> 1st512" and then "mv 1st512 goodmovie.avi" but this is not working. Am I wasting my time ? Do I smoke too much weed ? Is this the wrong list for this question ?