File signatures??

[Maf. King]

On Wednesday, 28 June 2017 14:40:09 BST matt at considine.net wrote:
> Hi,
> 
> I think this is the right venue to ask this question.  If not, I can
> hopefully get a pointer to where else to turn.
> 
> I need to figure out what - if any - file signatures could be used to
> identify gnucash data files.  The need arises from a harddisk crash and
> recovery effort, the result of which was a *lot* of files and file
> fragments recovered, but at the expense of the harddisk's directory
> structure and filenames (for the most part).  The harddisk in question
> has terabytes of data on it, so going through the disk manually is not
> practical.
> 
> On this disk were the data files for a non-profit which had a somewhat
> customized account tree structure.  What I am trying to figure out is if
> there are any unique headers to a minimum number of files that could be
> used to recreate the transactions and other data in gnucash?  If there
> are keywords or byte strings I can use, then I can use disk search tools
> for look for the files and fragments that are relevant and try to stitch
> things back together.
> 
> FWIW, I believe the account data was stored as XML rather than in a
> database.  And the version of gnucash I was using was whatever version
> was stable at the beginning of this calendar year.
> 
> Thanks in advance for any help or pointers.
> 
> Matt
> 
> PS I already understand the wisdom of having some backup elsewhere, so I
> can forgo that pointer.  The problem in this case was that this unit was
> also the backup.
> 

Hi Matt

from my system:

~> head myfile.gnucash
<?xml version="1.0" encoding="utf-8" ?>
<gnc-v2
     xmlns:gnc="http://www.gnucash.org/XML/gnc"
     xmlns:act="http://www.gnucash.org/XML/act"
     xmlns:book="http://www.gnucash.org/XML/book"
     xmlns:cd="http://www.gnucash.org/XML/cd"
     xmlns:cmdty="http://www.gnucash.org/XML/cmdty"
     xmlns:price="http://www.gnucash.org/XML/price"
     xmlns:slot="http://www.gnucash.org/XML/slot"
     xmlns:split="http://www.gnucash.org/XML/split"

Now, this is an uncompressed gc file from v 2.6.16, but dating back years; a 
file created this year has exactly the same first few lines though.

If your file was saved with compression turned on, then your task is probably 
harder - look for gz compressed files.

HTH,
Maf.