How to create custom IntelliRAW rules in older versions of UFS Explorer

Starting from version 9.4, the all editions of UFS Explorer are supplemented with a special editor for creating search rules straight in the program. Yet, if you use an older version of the software that doesn't offer this functionality, you may download an additional utility called IntelliRAW rules editor. It is available free of charge and provides the possibility for easy definition of custom file types for IntelliRAW as well as numerous options for their configuration. Using this tool, you can:

Create a new file with a custom file type, open an existing file and complement it with new file types, or even merge rules from several existing files;
Specify a file extension which will be assigned to the found files of the corresponding custom file type;
Provide a name for the type of the files which will also be used as the folder name in the results of raw recovery;
Specify a rule for the start of the file using one or several signatures in the form of a hexadecimal sequence, an ASCII or Unicode string. The software can be set to scan the entire data block in search for the needed pattern, find it in a block at a given offset or divide the block into sub-blocks of a given size and look for the pattern at a specified position.
Specify a rule for the end of the file:
- By a trailer signature and a specified number of bytes after it;
- By the size of the file defined as a field at a given offset with a given size. The value can be multiplied by the chosen integer and increased by the given number of bytes.
Define the circumstances under which the match will occur:
- The format of data (binary, ASCII or Unicode);
- The scope of analysis which can coincide with the parent object, be a subset of a particular size defined at a certain offset or by a given hexadecimal signature;
- Hit conditions: the defined rule can be set to apply for all instances, when none of the other rules matches, when all the defined signatures are found or when any of them hits.

The software also supports the following special commands:

Masks 4 bits of a hexadecimal number

e. g 0?11 may mean 0011, 0111…0F11

*N*

Any value for N bytes

e. g *12* means any 12 bytes

!N!

Not equals to byte value

e. g !0!, !FF!, etc.

{b,…}

Enumerates valid bytes

e. g {00,?1,1F}

's'

Encloses an ASCII string

e. g 'template'

"s"

Encloses a Unicode string

e. g "template"

' s '

Encloses a UTF-8 string

e. g ' template '

Makes all the following strings case-sensitive

e. g +"Template"

Makes all the following strings case-insensitive

e. g -"template"

[XXX/YYY]

Matches the hex value of XXX by mask YYY

e. g [F80/FFC]

If you are going to specify custom IntelliRAW rules in an older version of UFS Explorer (up to 9.3), take the following steps:

Obtain the signature distinguishing your file type as described in How to create custom IntelliRAW rules in older versions of UFS Explorer.
After that, download IntelliRAW rules editor. In this utility, you can create a file with rules for this file type that will be used by UFS Explorer.
Run the software, create a new file by pressing the "New file" button and click "New type". In the opened tab, provide the name of the file type and the file extension. In our case, these are JPEG images and jpg.
Define the obtained signature for the file start. For this, press the "Start" button and paste the signature in the "Search for" field. If the position of the signature is different from 0x0, provide it in the "Position" field and hit "OK".
If your file type has a signature for the end of the file, provide a rule for it as well. To do that, click "Termination" and select "Matching signature" in the opened menu. Paste the ending signature in the "Search for" field and hit "OK".
If available, provide additional parameters for file search or proceed with the default ones.
Change the "Rule hits" status to "active" and save the created rule to a file using the "Save file" button.
In the interface of UFS Explorer, when you get to the step of defining the parameters for a scan, check off "I'm interested in the result of recovery by known content" and "I want to use my own data search rules". Press "Load rules", navigate to the *.urrs-file you've created, and hit "OK".

After you proceed to scanning, UFS Explorer will employ your rule and list the files located with its help in a separate $Custom folder. They will receive new names, as this information is lost altogether during raw recovery.

Last update: March 21, 2022

Compartilhe: