Recent Posts

Pages: [1] 2 3 ... 10
Definitions DB change log / Re: Current
« Last post by Mark0 on Today at 12:36:18 AM »
  • Storm Shell project/makefile ()
  • AmigaWriter document ()
  • Blockbench 3D Model (BBMODEL)
  • FLIP Bitmap (FBI)
  • Funny Paint bitmap (FUN)
  • JSON Entity Model (JEM)
  • Fullscreen Construction Kit bitmap (460x274) (KID)
  • Fullscreen Construction Kit bitmap (456x274) (KIL)
  • Fullscreen Construction Kit bitmap (448x274) (KIT)
  • Minecraft Resource Pack info (MCMETA)
  • Siva archive (generic) (SIVA)
  • Siva archive (v1) (SIVA)
  • StormWIZARD resource (WIZARD)
Thanks for the info. At the moment I don't think it's really necessary to add the second extension, but I will surely give it some thought.
Hello trid users,

some days ago i run TrID with verbose option on Windows imaging found
in directory sources on recovery USB stick for modern Windows systems

Besides a hidden system marked boot.wim and a Reconstruct.WIM there exist
also a Reconstruct.WIM2. All are described correctly as "Windows Imaging Format"
by wim-nosplit.trid.xml or "Windows Imaging Format (generic)" by
wim.trid.xml ( see appended output/trid-v.txt).

Unfortunately the used file name extension "WIM2" in last image is not
mentioned in Ext line inside trid definitions.

So i add this file name extension inside the 2 definitions wim.trid.xml and

The procedure to reproduce such image  is describe for example on web page

Start Microsoft’s recovery drive creating tool "RecoveryDrive.exe", which
normally found in System32 sub directory inside Windows directory.

If the option to back up system files to the recovery drive is chosen
additional disc image with WIM format are created. The first is called
Reconstruct.WIM and the second is called Reconstruct.WIM2. So i mention this
fact in remark line, because for splited multiple part images normally file
name extension "swm" is used. I found no explanation why here WIM2 is used.

The tool also creates a file $PBR_ResetConfig.xml with XML based
instructions to reconstruct the Windows operating system disc. Apparently by
"DiskpartScriptPath" directive referring to script $PBR_Diskpart.txt the tool
DISKPART.EXE is called with instructions to partition and format the system disc.

I do not know if these observations are always true, because i found no precise
description of the recovery process.

With the 2 updated trid definitions now also Windows image Reconstruct.WIM2
is now described with unusual file name extension "WIM2" ( see appended
output/trid-v-new.txt) more precisely. TrID definitions and output are
stored in archive I hope that all 2 XML files can be used in
future version of triddefs.

With best wishes
Jörg Jenderek
Definitions DB change log / Re: Current
« Last post by Mark0 on August 10, 2020, 03:16:40 PM »
  • Detached PDS Label info (v3) (LBL)
  • PCB ASCII Printed Circuit Board (PCB)
  • SQ2 compressed data ()
  • ZSQ compressed data ()
  • ELAN Annotation Format (EAF)
  • ELAN Annotation Format (UTF-8) (EAF)
  • GAPFile (v1.0) (GAP)
  • Norton Commander module message (ENG) (MSG)
  • DOSBox-X Save state (SAV)
  • Circuit Maker chart (SSF)
  • JavaHelp TOC (XML)
  • NASA Planetary Data System image (IMQ/IMG)
Definitions DB change log / Re: Current
« Last post by Mark0 on August 05, 2020, 10:52:07 PM »
  • Claris Works document (CWK)
  • Delphi Package (DPK)
  • Delphi Package (with rem) (DPK)
  • Vocal-Eyes Help (HLP)
  • StarDict Info (IFO)
  • TOPBENCH data base (INI)
  • KeyTronic Trakball profile (PRO)
  • Paintworks bitmap (SC0/SC1/SC2)
  • Vocal-Eyes Set (SET)
Hello trid users,

some days ago i handled some Novell message files with msg file name

Just for interest i look on my disc for other files with that file
name extensions. Some still are described as "Unknown!" by TrID (see
appended output/trid-old.txt).

For comparison reason i also run file(1) command on such samples. Some are
described as ASCII text and others are described as data.

Here i look only at the "data" described files. Some are only found in
directory where the Norton Commander was installed. So i know that such MSG
samples are part of Norton Commander suite.

So i run tridscan on these samples and i get a trid definition file
Characteristic for such message files is a typical ASCII phrase like Abort
or Aborting like in NCVIEW.MSG at the beginning. That is expressed by XML
construct like:
   <ASCII> A b o r t</ASCII>
The messages seems to be separated by null bytes. Therefor such files are not
considered as ASCII text by file command.

Furthermore all message contain some same error messages. That are
found in global strings section by lines like:
   <String>PRINTER OUT OF PAPER</String>
   <String>UNKNOWN DISK DRIVE</String>
   <String>ERROR ON DEVICE %</String>
   <String>SHARING VIOLATION</String>
   <String>ERROR ON DRIVE %</String>
   <String>SECTOR NOT FOUND</String>
   <String>UNKNOWN COMMAND</String>
   <String>NETWORK ERROR</String>
   <String>NON-DOS DISK</String>
   <String>BAD REQUEST</String>
   <String>WRITE FAULT</String>
   <String>DATA ERROR</String>
   <String>READ FAULT</String>
   <String>SEEK ERROR</String>

I have only tested with Norton Commander versions DOS 5.50 English and
DOS PACKER.MSG of Windows 2.01. So i mention this fact in remark line.
Zhe German version of MSG files are not matched because the start with
German word "Abbrechen" instead English "Abort".

For most MSG example exist a DOS executable with same main name and
file name extension EXE. The message file is used by executable to
display text messages. If the message file is missing the
corresponding program complains with "Unable to read message file".

Some information about Norton Commander is found on Wikipedia. This is
expressed by reference URL line like: 

With the new definition the undetected Norton Commander messages are now
described (see appended output/trid-new-v.txt). TrID definition, some
examples and output are stored in archive I hope that my XML
file can be used in future version of triddefs.

The file command displays "application/x-dosexec" for Norton Commander
DOS executable (See output/file-5.39-i.txt) whereas TrID only
displays a generic "application/octet-stream" (see

With best wishes
Jörg Jenderek
Definitions DB change log / Re: Current
« Last post by Mark0 on August 02, 2020, 03:19:08 PM »
  • Kodak FlashPix bitmap (FPX)
  • GNAT Ada Library Information (ALI)
  • Cura Profile settings (CURAPROFILE)
  • Turbo Rascal Syntax Error graphic (FLF)
  • Cura profile settings (legacy) (INI)
  • Ani ST Script (SCR/STR)
Definitions DB change log / Re: Current
« Last post by Mark0 on July 29, 2020, 02:48:01 AM »
  • Novell Packed data ()
  • Tascam BB-serie firmware ()
  • Tascam DP-serie firmware ()
  • Yamaha MBDF Archive firmware(BIN)
  • Sunplus Burn firmware update (BRN)
  • CompuServe Information Manager DB key/index (DAT/DB)
  • Dune Firmware File (DFF)
  • Dune Service File (DSF)
  • Dante firmware update (DNT)
  • Home Video Producer Font (FNT)
  • Novell 16-bit LAN driver Installer data (INS)
  • ROFF 3D animation (ROF)
  • Fusion 360 Simulation Mesh DB (SIMMESHDB)
  • Tascam DM-3200 firmware (TFI)
  • Tascam DM-4800 firmware (TFI)
Definitions DB change log / Re: Current
« Last post by Mark0 on July 26, 2020, 02:48:34 PM »
  • Adobe Premiere Title (LE) (PRTL)
  • XFDL form (XFDL)
  • After Effects Project XML (AEPX)
  • Manhattan Printer Description (MPD)
  • OS/2 help Message (generic) (MSG)
  • OS/2 help Message (v0) (MSG)
  • OS/2 help Message (v2) (MSG)
  • Adobe Premiere Title (BE) (PRTL)
  • XFDL form (base64-gzip) (XFDL)
Pages: [1] 2 3 ... 10