File signatures??

[MattC]

Thank you.  That is exactly what I'm looking for.  Fwiw, it appears that searching for "trans_guild" identifies log files/fragments.  So I'm hoping that piecing those together migjt be a successful "plan b".   I think that leaves the category structure to try to figure out, as well as - though less importantly - customized reports.

I'll report back how it goes, but if anyone has suggestions for other files to search for, I'd appreciate the input.

Matt


Sent from my Verizon Wireless 4G LTE smartphone

<div>-------- Original message --------</div><div>From: "Maf. King" <maf at chilwell.net> </div><div>Date:06/29/2017  4:31 AM  (GMT-05:00) </div><div>To: gnucash-user at gnucash.org </div><div>Cc: matt at considine.net </div><div>Subject: Re: File signatures?? </div><div>
</div>On Wednesday, 28 June 2017 14:40:09 BST matt at considine.net wrote:
> Hi,
> 
> I think this is the right venue to ask this question.  If not, I can
> hopefully get a pointer to where else to turn.
> 
> I need to figure out what - if any - file signatures could be used to
> identify gnucash data files.  The need arises from a harddisk crash and
> recovery effort, the result of which was a *lot* of files and file
> fragments recovered, but at the expense of the harddisk's directory
> structure and filenames (for the most part).  The harddisk in question
> has terabytes of data on it, so going through the disk manually is not
> practical.
> 
> On this disk were the data files for a non-profit which had a somewhat
> customized account tree structure.  What I am trying to figure out is if
> there are any unique headers to a minimum number of files that could be
> used to recreate the transactions and other data in gnucash?  If there
> are keywords or byte strings I can use, then I can use disk search tools
> for look for the files and fragments that are relevant and try to stitch
> things back together.
> 
> FWIW, I believe the account data was stored as XML rather than in a
> database.  And the version of gnucash I was using was whatever version
> was stable at the beginning of this calendar year.
> 
> Thanks in advance for any help or pointers.
> 
> Matt
> 
> PS I already understand the wisdom of having some backup elsewhere, so I
> can forgo that pointer.  The problem in this case was that this unit was
> also the backup.
> 

Hi Matt

from my system:

~> head myfile.gnucash
<?xml version="1.0" encoding="utf-8" ?>
<gnc-v2
     xmlns:gnc="http://www.gnucash.org/XML/gnc"
     xmlns:act="http://www.gnucash.org/XML/act"
     xmlns:book="http://www.gnucash.org/XML/book"
     xmlns:cd="http://www.gnucash.org/XML/cd"
     xmlns:cmdty="http://www.gnucash.org/XML/cmdty"
     xmlns:price="http://www.gnucash.org/XML/price"
     xmlns:slot="http://www.gnucash.org/XML/slot"
     xmlns:split="http://www.gnucash.org/XML/split"

Now, this is an uncompressed gc file from v 2.6.16, but dating back years; a 
file created this year has exactly the same first few lines though.

If your file was saved with compression turned on, then your task is probably 
harder - look for gz compressed files.

HTH,
Maf.