Need TiVo file signature for recovering files from crashed USB drive

3007 Views 2 Replies 3 Participants Last post by Darr247, Jun 14, 2011

dougblair

Discussion Starter · May 19, 2011

My apologies for the excessively technical question. Engineers, please read on!
I have a TiVo Series 3 HD (two cable cards), and TiVoToGo, and the Roxio Toast 11 package for transferring TiVo'd shows to my MacBook Pro and storing them on an external Seagate 3TB USB drive. This arrangement has worked well for several years (and several drives - 21 TB worth!), but one of my USB drives has failed.

After some conversation with Seagate, and attempts to repair the disk using my MacOS 10.6 (Snow Leopard) disk utility have resulted in an "invalid B-tree node" failure, the Seagate folks have recommended that I purchase and use their File Recovery software to scan the disk and piece together as many of the files as can be recovered. The scan works, and I have isolated a group of bad sectors to avoid during the scans, but the scan utility does not recognize the file signature of a TiVo file and cannot automatically detect these the way it can detect other file types like .jpg or .docx or .mp4 files.

There is a way to add additional file types to the scanning program, entering the details in an .xml file. Here is an example of this from the scanning program manual:

Signature file example
<?xml version="1.0" encoding="utf-8"?>
<FileTypeList>

<FileType id="5626" group="System Files" description="MFT" features="TXT_ANSI TXT_UNICODE">
<Signature offset="0" from="begin" count="1">FILE</Signature>
<Signature offset="4" from="end" count="1">$\x00M\x00F\x00T</Signature>
</FileType>
</FileTypeList>

I need to know the corresponding information for the .TiVo files. There are some additional fields (xml tags) for description and file extension (".TiVo") which I can figure out, and the <features> control only the behavior of the scanning program. The information I need is the type ID, signature(s) and so forth, which I rather suspect someone on this forum knows inside out

Thank you for whatever help you can provide!

Doug

See less See more

Save

1 - 3 of 3 Posts

ggieseke

· #2 · May 19, 2011

The file header is 16 bytes and starts with "TiVo" (0x54 0x69 0x56 0x6F). It's followed by 3 XML 'chunks' and then the MPEG-2 data. Each XML chunk has its own 12 byte header. The first XML chunk is in the clear and contains the copyright notice. Everything else is encrypted except for some of the MPEG-2 header blocks like pack start codes and the program end code.

Have your software look for files that start with the file header signature, then have it look for the XML copyright notice 28 bytes from the beginning of the file. It starts with "<?xml version="1.0" encoding="utf-8"?>".

The last 4 bytes of the file should be 0x00 0x00 0x01 0xB9, which is the MPEG-2 program end code.

That should be enough to define a custom file type to your recovery software. If it can't recover the NTFS system files to figure out the file size and follow the fragments through the file system you're probably out of luck unless the disk was completely defragmented.

For more details you can Google the tivodecode source code. Good luck.

Greg

See less See more

Save

Darr247

· #3 · Jun 14, 2011

If you want one for cgsecurity.org's PhotoRec program, here's what I came up with for a line in the photorec.sig file in my %userprofile% subdirectory

Code:

tivo 0 0x5469566F000400

then its fidentify_win.exe program properly identifies .tivo files.

Now to let PhotoRec start scanning (with 'custom' checked for file type) the drive that windows alternately says is NTFS then RAW with consecutive runs of CHKDSK /F (and won't touch in either case, anyway).

That file would be /home/[username]/.photorec.sig in linux, for what it's worth.

Save

1 - 3 of 3 Posts

This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.

Top Contributors this Month