File signatures??

[matt at considine.net]

Hi,

I think this is the right venue to ask this question.  If not, I can 
hopefully get a pointer to where else to turn.

I need to figure out what - if any - file signatures could be used to 
identify gnucash data files.  The need arises from a harddisk crash and 
recovery effort, the result of which was a *lot* of files and file 
fragments recovered, but at the expense of the harddisk's directory 
structure and filenames (for the most part).  The harddisk in question 
has terabytes of data on it, so going through the disk manually is not 
practical.

On this disk were the data files for a non-profit which had a somewhat 
customized account tree structure.  What I am trying to figure out is if 
there are any unique headers to a minimum number of files that could be 
used to recreate the transactions and other data in gnucash?  If there 
are keywords or byte strings I can use, then I can use disk search tools 
for look for the files and fragments that are relevant and try to stitch 
things back together.

FWIW, I believe the account data was stored as XML rather than in a 
database.  And the version of gnucash I was using was whatever version 
was stable at the beginning of this calendar year.

Thanks in advance for any help or pointers.

Matt

PS I already understand the wisdom of having some backup elsewhere, so I 
can forgo that pointer.  The problem in this case was that this unit was 
also the backup.