recover_ee7_files/signatures.yaml at main · articuly/recover_ee7_files · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# 自定义文件头签名规则 — 用户可自行扩展
signatures:
  # --- 加密/特殊 PDF ---
  - name: "加密PDF文档"
    hex_pattern: "25504446"           # %PDF
    offset: 0
    extension: ".pdf"
    mime: "application/pdf"
    confidence: 0.95
    description: "PDF文档（可能含加密）"

  # --- 常见但 magic 可能误判的格式 ---
  - name: "RAR压缩包"
    hex_pattern: "526172211A07"       # Rar!..
    offset: 0
    extension: ".rar"
    mime: "application/x-rar-compressed"
    confidence: 0.99

  - name: "7z压缩包"
    hex_pattern: "377ABCAF271C"       # 7z..
    offset: 0
    extension: ".7z"
    mime: "application/x-7z-compressed"
    confidence: 0.99

  - name: "SQLite数据库"
    hex_pattern: "53514C69746520666F726D6174"  # SQLite format
    offset: 0
    extension: ".db"
    mime: "application/x-sqlite3"
    confidence: 0.99

  - name: "MOBI电子书"
    hex_pattern: "424F4F4B4D4F4249"   # BOOKMOBI
    offset: 60
    extension: ".mobi"
    mime: "application/x-mobipocket-ebook"
    confidence: 0.99
    description: "MOBI 电子书"

  # --- 用户可在此处追加新规则 ---