What are the numbers in parentheses

[Shehi]

hey marco,

when i run trid.exe thru command line to identify a file, at the end of each identification line, numbers such as (5000/1/2) appear. What do they mean? And is there any chance for me to see what exactly was detected in Hex level of file and at which offset? I ask for this reason:

Quicktime movies, usually with .mov extension may have one these two strings at offset 4: moov and mdat. Additionally, in H263+ encoded new generation mov's, we can see "ftypeqt" instead. Now, when I run file thru TrID, it identifies the file correctly, but HOW? In your XML signature file, there is no mention of "ftypeqt" in video-mov.xml.

Thanks for your answer in advance.

Shehi

[Shehi]

Oh, and when I try to download the definitions file from http://mark0.net/download/triddefs.zip , I can't extract files within - "Unexpected end of archive" Winrar says. Could you please update the file there? Thanks...

Note: Please don't use 7-zip to make ZIP files, it is problematic sometimes. Its because the author does not follow magic-number signature standards - e.g. try creating TAR file with 7zip and IZArc, and run both files thru TrID, you will see. 7-zip lacks "USTAR" signature in TAR files, because... well read for yourself: http://sourceforge.net/projects/sevenzip/forums/forum/45797/topic/3686403

[Mark0]

when i run trid.exe thru command line to identify a file, at the end of each identification line, numbers such as (5000/1/2) appear. What do they mean?

The only "interesting" results is the first number, witch is the score obtaining evaluating all the patterns present in that filetype definitions, depending on lenght, positions, etc. The other two refer to the number of patterns and strings, but essentialy were interesting just for me while adjusting the score functions, rather than for the user.

And is there any chance for me to see what exactly was detected in Hex level of file and at which offset?

No.

Quicktime movies, usually with .mov extension may have one these two strings at offset 4: moov and mdat. Additionally, in H263+ encoded new generation mov's, we can see "ftypeqt" instead. Now, when I run file thru TrID, it identifies the file correctly, but HOW? In your XML signature file, there is no mention of "ftypeqt" in video-mov.xml.

Can't say specifically without checking the code and the defintions, but I think in the def there are probably some less evident pattern that still differentiate the two types.

[Mark0]

Oh, and when I try to download the definitions file from http://mark0.net/download/triddefs.zip , I can't extract files within - "Unexpected end of archive" Winrar says. Could you please update the file there? Thanks...

The file is fine. I just tried to download and test/unpack it.

As for Z-Zip, I find it fine for my uses.

[Shehi]

Well, I still can't extract the file with Winrar. Any ideas why? In my office comp, I don't have any other extractor, so maybe you can attach definition file without compression here, in this topic, please. Thanks.

[Mark0]

I'm not at my usual PC at the moment.
But you probably just need a more recent version of RAR.
Either that or an antivirus is interfering in some ways.

[Shehi]

Nope, doesnt work... Please attach the file here at your earliest convenience.

[Mark0]

Disregard the comment about RAR; I was thinking about the compressed file with the XML definitions.
This is just a normal .ZIP, so I don't see any reasons for witch it can't be unpacked.

I'm sending the non compressed file to your mail address (don't want to post here a file that will be old / non current very soon).

Bye!