Few days ago I posted an article on how to recover CHK files created by chkdsk and scandisk. CHK files are actually files from your computer but it’s renamed to FILE0001.CHK and so on… You can actually rename back to its original extension to get back your data BUT the biggest problem is, we don’t know where is the file from and what is the original filename and extension. With the CHK recovery tools that I’ve listed, it will try to recognize the original file type from the header.

However, most of the CHK recovery programs can only recover CHK files. What if you received an attachment from your friend and it has no extension? Is it a powerpoint slide? Is it a short video clip? Is it an audio file? Or is it a zipped file? There are so many possibilities and trying one by one is not a real solution.

Fortunately I have a simple solution to identifying unrecognized file types.

One of trick is you can rename the unrecognized file to FILE0001.CHK and use any CHK recovery program to help you identify the extension.

A better way would be using a free program suggested by Terence Hill called TrID that can scan any files and identify file types from their binary signatures. TrID is better than CHK recovery program because it doesn’t hard code the binary signatures. Instead, it is extensible and can be trained to recognize new formats in a fast and automatic way. Currently TrID has over 3000 file type / file extension definitions.

There are 3 ways on how to use TrID to identify unrecognized file types.

1. Online (Online TrID)

- Just browse for the file that you want to identify the file type and upload. Sending a file may take some time, and you will not get any feedback during that phase. Good thing about Online version of TrID is you don’t need to download any files but the bad thing about it is you can’t upload more than 1 files. Also it is advised not to upload confidential or reserved files because sent files could be analyzed for extracting patterns and improving the file types database.

[ Identify Files Types with Online TrID ]

2. Command Line (TrID)

- The command line TrID is the only method that you can scan groups of files, entire folders, etc. Just run TrID and point it to the file to be analyzed. The file will be read and compared with the definitions in the database. Results are presented in order of highest probability. Run trid.exe in command prompt without switches will give you a list of commands that you can use. Make sure you download the definition file TrIDDefs.TRD and place it at the same location as trid.exe.

[ Download TrID | Definitions ]

3. Graphical User Interface (TrIDNet)

- TRIDNet is the GUI version of TrID, probably more practical to use than the CLI version, especially for those not very familiar with the command line prompt. In addition, with a simple double click, it have the ability to display a series of information about every match listed: the definition’s file name, its author & e-mail address (if provided), a clickable link to a reference URL, remarks, etc. The definition file format is different from the command line version. TrIDNet’s definition is in XML format. Just download the archive with the XML defs and unpack it into the same folder as TrIDNet. Microsoft .NET Framework is required to run TrIDNet.

[ Download TrIDNet | XML Definitions ]

What if you have a file type that is not in the definition lists? No worries as you can easily create the definition yourself with TrIDScan. TrIDScan is a pattern scanner and it creates new definitions to be used with TrID. Let’s say you want to create a definition for Java Class files and you have a collection of them. Put your file collection into a directory (folder) of it’s own. The more varied your collection in size and compression, the better the results. Run TrIDScan against the folder. That’s all there is to it; the program does the rest. Read more about it here.

[ Download TrIDScan ]

Technorati Tags: unknown, unrecognized, identify, extension, file type