Need TiVo file signature for recovering files from crashed USB drive

Discussion in 'TiVo Home Media Features & TiVoToGo' started by dougblair, May 19, 2011.

  1. dougblair

    dougblair New Member

    5
    0
    Feb 22, 2009
    My apologies for the excessively technical question. Engineers, please read on!
    I have a TiVo Series 3 HD (two cable cards), and TiVoToGo, and the Roxio Toast 11 package for transferring TiVo'd shows to my MacBook Pro and storing them on an external Seagate 3TB USB drive. This arrangement has worked well for several years (and several drives - 21 TB worth!), but one of my USB drives has failed.

    After some conversation with Seagate, and attempts to repair the disk using my MacOS 10.6 (Snow Leopard) disk utility have resulted in an "invalid B-tree node" failure, the Seagate folks have recommended that I purchase and use their File Recovery software to scan the disk and piece together as many of the files as can be recovered. The scan works, and I have isolated a group of bad sectors to avoid during the scans, but the scan utility does not recognize the file signature of a TiVo file and cannot automatically detect these the way it can detect other file types like .jpg or .docx or .mp4 files.

    There is a way to add additional file types to the scanning program, entering the details in an .xml file. Here is an example of this from the scanning program manual:

    Signature file example
    <?xml version="1.0" encoding="utf-8"?>
    <FileTypeList>
    <!-- Search for NTFS MFT -->
    <FileType id="5626" group="System Files" description="MFT" features="TXT_ANSI TXT_UNICODE">
    <Signature offset="0" from="begin" count="1">FILE</Signature>
    <Signature offset="4" from="end" count="1">$\x00M\x00F\x00T</Signature>
    </FileType>
    </FileTypeList>

    I need to know the corresponding information for the .TiVo files. There are some additional fields (xml tags) for description and file extension (".TiVo") which I can figure out, and the <features> control only the behavior of the scanning program. The information I need is the type ID, signature(s) and so forth, which I rather suspect someone on this forum knows inside out :)

    Thank you for whatever help you can provide!

    Doug
     
  2. ggieseke

    ggieseke Well-Known Member

    5,695
    702
    May 30, 2008
    The file header is 16 bytes and starts with "TiVo" (0x54 0x69 0x56 0x6F). It's followed by 3 XML 'chunks' and then the MPEG-2 data. Each XML chunk has its own 12 byte header. The first XML chunk is in the clear and contains the copyright notice. Everything else is encrypted except for some of the MPEG-2 header blocks like pack start codes and the program end code.

    Have your software look for files that start with the file header signature, then have it look for the XML copyright notice 28 bytes from the beginning of the file. It starts with "<?xml version="1.0" encoding="utf-8"?>".

    The last 4 bytes of the file should be 0x00 0x00 0x01 0xB9, which is the MPEG-2 program end code.

    That should be enough to define a custom file type to your recovery software. If it can't recover the NTFS system files to figure out the file size and follow the fragments through the file system you're probably out of luck unless the disk was completely defragmented.

    For more details you can Google the tivodecode source code. Good luck.

    Greg
     
  3. Darr247

    Darr247 New Member

    32
    0
    Mar 21, 2010
    Michigan
    If you want one for cgsecurity.org's PhotoRec program, here's what I came up with for a line in the photorec.sig file in my %userprofile% subdirectory

    Code:
    tivo 0 0x5469566F000400
    then its fidentify_win.exe program properly identifies .tivo files.

    Now to let PhotoRec start scanning (with 'custom' checked for file type) the drive that windows alternately says is NTFS then RAW with consecutive runs of CHKDSK /F (and won't touch in either case, anyway).

    That file would be /home/[username]/.photorec.sig in linux, for what it's worth.
     

Share This Page