Photorec custom signature - recovery

Recently I have lost my database files after server (Qnap) reboot.
I need to recover the MYD files.
I'm using the Photorec to recover my files which uses file signatures.
I know that MYD files doesn't have common file signature.
I've recreated the database from the earlier backup (on local machine) just to check if the signature changes when new data inserted and it seams like the signature bit is not changing.
I'm not sure if that means I have the signature of the file that I'm looking for.
I've tried to create a photorec.sig file and entered MYD 0 0x00010065fe00000100003101aa70010f00 which are the first 34 chars of the hexdump result.
I've saved this file into the current working directory and ~/.photorec.sig and tried to recognize the MYD file with fidentify_static which always returns unknown.
I think there is something wrong with the signature file that I've created. Can anyone tell me how to make sure that the signature file is created correctly and placed to the right place on qnap?

Run fidentify with the file/directory as the parameter:
[kmaster#adsl ~]$ fidentify /home/kmaster/src/testfiles/sample.pfi
See http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec

Related

In Resilio Sync, how to add multiple keys at once

With Resilio Sync, I'm looking for a way to add multiple keys at once with a CSV file or run a script or copy-paste to a config file or whatever else.
Currently, I have a list of 10 keys I must set up on a laptop.
For each I have to click the '+' then 'Enter a key then copy paste the path to the folder I created for it.
I would prefer to have a list like this I could just load or parse with a script.
KEY,Folder Path,Selective sync
I6HK76FRZS...,C:\Sync\Folder1,No
76FRI6HKZS...,C:\Sync\Folder2,No
HK76FI6RZS...,C:\Sync\Folder3,No
.....
This would help reduce errors in copying and pasting information.
I've tried exploring the Internet and it looks like no one else has ever needed to do anything like this. :/ Hard to believe.
I've also tried researching the config file to see if I could add the information there.
https://help.resilio.com/hc/en-us/articles/206178884-Running-Sync-in-configuration-mode#windows
Storing the information permanently in raw text on a config file does not sound ideal.

How to specify filepath for KDB tickerplant to save data to at End of Day

I'm wondering how to specify a filepath for my tick setup to save to when .u.endofday is sent from the tickerplant. Currently, when this message is sent the RDB is saved to the working directory where the tick.q file is.
Is there away to pass in a file path so that it is saved to ../../HDB rather than ../../Tick?
In the vanilla r.q script, the tables are saved down using
.Q.hdpf[`$":",.u.x 1;`:.;x;`sym]
where the second parameter is the directory that the tables are saved to.
`:.
represents the current directory. You can change it to something else, for example `:/home/data/hdb
https://code.kx.com/q/ref/dotq/#qhdpf-save-tables
If you are using the plain r.q script, referring to
https://github.com/KxSystems/kdb-tick/blob/master/tick/r.q
There is a comment under .u.rep, suggesting to modify the 'system cd' command, where you can specify any directory you like. This will change the directory inside the r.q process. Then when .Q.hdpf is called it will save the tables to that directory. The rdb calls .u.rep on start up.
.u.rep:{(.[;();:;].)each x;if[null first y;:()];-11!y;system "cd ",1_-10_string first reverse y};
/ HARDCODE \cd if other than logdir/db
You could have
system "cd /home/data/hdb"
which will change the current directory to this location
Depending on your setup there is couple of ways to do this.
But I think the most efficient would be for you to look at the .u.end function that is called in you RDB and see what save down function is used there.
Search the place where .u.end is defined on the RDB and look at the save_down functions.
Look for .Q.dpft which is most likely or there is set command.
Documentation on the .Q.dpft:
https://code.kx.com/q/ref/dotq/#qdpft-save-table
Where the first argument that is fed in is the directory path.
So could add a directory there in the form of
hsym `$"/path/path/HDB"
Which returns
`:/path/path/HDB
as a symbol to be inserted to the function.
There might be different ways of tables being saved down, but that is most likely way it is done.
There is also different ways to choose a directory with par.txt file that is loaded in. So useful to see if par.txt file is loaded in with the .Q.par function called on the RDB.
.Q.par[`:.;.z.d;`]
if the answer is just:
`:./2020.05.09/
That means it is using the directory you launched the script in.
Here you can find some more documentation on this:
https://code.kx.com/q/kb/partition/

Force overwrite or delete file in use (executable that currently runs)

I'm looking for solution to delete or (preferably directly) overwrite source of an exe file while it is running.
To explain further before you get it all wrong, I'll give an example:
I have an exe file on drive D:\ which I run (with previously posted question's answer, giving params to "Start in" folder on C:\Program Files\MyProgram\" so it finds its dlls.
Now after the file is running, I'd like to rewrite the file's byte stream (just like opening it in hex editor...), or at least delete it so I can copy over new exe file directly using same name.
So far the solution I'm using is that I trigger format D: command for the whole drive D:\ (which, in my case is ramdisk and thumb-drive, as I only have this exe on it, I copy it there as necessary), since that removes the file and let's me copy new file there.
Trying to use del myProgram.exe even with -force flag triggers error that access to the file is denied. Same goes if I try to overwrite the contents of the file.
Is there any alternative to do that without using the format command, as that requires to have partition drive only for the purpose?
Update: Note: MoveFileEx and similar techniques that require termination of the process or system restart/reboot are not qualified as a solution. This should be done while the process is running without further actions that can compromise the process's run state.
On a side note, when formatting the drive using the Powershell's format command, the file is gone, although if viewing the partition using Hex viewer tool, there is full binary (hex) content of the exe visible there and an be restored using just as simple as copy-paste technique. This is one of the points as to where overwriting the file contents would be preferable than deleting the file directly.
Please note: This is a knowledge and skills based question, and would therefore appreciate sparing the moral and security-concerning comments about such actions and behaviour.
For deleting/replacing/overwriting a file at least two conditions must be met:
The user performing the operation must have the required permissions to do so. This can be verified for instance via Get-Acl or icacls.
Windows must not have an open handle to the file. This can be checked for instance with tools like Process Explorer or handle. These tools can also be used to forcibly close open handles, although that's not recommended as it may cause data loss and/or damage to the files in question. I'm not sure, though, if it's actually possible to close handles to an executable without terminating the process.
Note that antivirus software is likely to interfere with this kind of operation.
The basic problem here is that Windows loads from the .EXE upon demand, it's not all read in at once.
If you destroy the original file what happens when it tries to load in a page that no longer exists?
If I had to write something of this sort I would copy the .exe to a temporary location (beware that running code from the temp directory may be prohibited), run the new .exe, terminate the old one and then do what I want to it.

Matlab creates permissionless files

I have a script in MATLAB that outputs various files, including NIFTI (MRI images) files and text log files. Sometimes the output files that are created have their file permissions set to no read or write for anyone, including the file owner, and this appears to occur randomly.
This normally isn't a problem unless it occurs with the logs, as it leads MATLAB to endlessly recurse as it tries to write the error to the logs. Unfortunately, I haven't been able to find anyone who has experienced similar behavior from any program, including MATLAB.
The script, input files, and output files are all located on a NAS drive connected to a server running Ubuntu 14.04, so I'm wondering if this is a problem with the script (probably not because it happens intermittently regardless of input), the matlab environment, or the NAS drive.
I'm not sure why yoru fileattributes/permissions are changing, but I know the solution. You want file attributes if you know chmod from unix this should be familiar, if not you will still be fine
something like this will make your files writeable for all user groups on a unix (ubuntu) system
fileattrib('/home/work/results/my_file.log','+w','a')
edit
since these files are non-existant this may work better. Simply use fopen with the 'w+' flag. Which means write mode for appending. The + will also create the file if it doesn't exist(and you have permission to create files in the specified directory)
fid = fopen('my_new_log.txt','w+');
fprintf(fid,'some strings for my file');
fclose(fid);
it is also important you make sure to close the file after you are done.

Talend tWaitForFile insufficiency

We have a producer process that write files into a specific folder, which run continuously, we have to read files one by one using talend, there is 2 issues:
The 1st: tWaitForFile read only files which exist before its starting, so files which have created after the component starting are not visible for it.
The 2nd: There is no way to know if the file is released by the producer process, it may be read while it is not completely written, the parameter _wait_release_ of tWaitForFile does not work on Linux system !
So how can make Talend read complete written files from a directory that have an increasing files number ?
I'm not sure what you mean by your first issue. tWaitForFile has options to trigger when files are created, modified or deleted in a folder.
As for the second issue, your best bet here is for the file producer to be creating an OK or control file which is a 0 byte touch when it has finished writing the file you want.
In this case you simply look for the appearance of the OK file and then pick up the relevant completed file. If you name the 2 files the same but with a different file extension (the OK file is typically called ".OK" then this should be easy enough to look for. So you would set your tWaitForFile to look for "*.OK" files and then connect this to an iterate to a tFileInputDelimited (in the case you want to pick up a delimited text file) and then declare the file name as ((String)globalMap.get("tWaitForFile_1_CREATED_FILE")).substring(0,((String)globalMap.get("tWaitForFile_1_CREATED_FILE")).length()-3) + ".txt"
I've included some screenshots to help you below: