--- /dev/null
+#
+# Foremost configuration file
+#-------------------------------------------------------------------------
+# Note the foremost configuration file is provided to support formats which
+# don't have built-in extraction functions. If the format is built-in to foremost
+# simply run foremost with -t <suffix> and provide the format you wish to extract.
+#
+# The configuration file is used to control what types of files foremost
+# searches for. A sample configuration file, foremost.conf, is included with
+# this distribution. For each file type, the configuration file describes
+# the file's extension, whether the header and footer are case sensitive,
+# the maximum file size, and the header and footer for the file. The footer
+# field is optional, but header, size, case sensitivity, and extension are
+# not!
+#
+# Any line that begins with a '#' is considered a comment and ignored. Thus,
+# to skip a file type just put a '#' at the beginning of that line
+#
+
+# Headers and footers are decoded before use. To specify a value in
+# hexadecimal use \x[0-f][0-f], and for octal use \[0-3][0-7][0-7]. Spaces
+# can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".
+#
+# To match any single character (aka a wildcard) use a '?'. If you need to
+# search for the '?' character, you will need to change the 'wildcard' line
+# *and* every occurrence of the old wildcard character in the configuration
+# file. Don't forget those hex and octal values! '?' is equal to 0x3f and
+# \063.
+#
+# If you would like to extract files without an extension enter the value
+# "NONE" in the extension column (note: you can change the value of this
+# "no suffix" flag by setting the variable FOREMOST_NOEXTENSION_SUFFIX
+# in foremost.h and recompiling).
+#
+# The ASCII option will extract all ASCII printable characters before and after
+# the keyword provided.
+#
+# The NEXT keyword after a footer instructs foremost to search forwards for data
+# that starts with the header provided and terminates or is followed by data in
+# the footer -- the footer data is not included in the output. The data in the
+# footer, when used with the NEXT keyword effectively allows you to search for
+# data that you know for sure should not be in the output file. This method for
+# example, lets you search for two 'starting' headers in a document that doesn't
+# have a good ending footer and you can't say exactly what the footer is, but
+# you know if you see another header, that should end the search and an output
+# file should be written.
+
+# To redefine the wildcard character, change the setting below and all
+# occurances in the formost.conf file.
+#
+#wildcard ?
+#
+# case size header footer
+#extension sensitive
+#
+#---------------------------------------------------------------------
+# EXAMPLE WITH NO SUFFIX
+#---------------------------------------------------------------------
+#
+# Here is an example of how to use the no extension option. Any files
+# containing the string "FOREMOST" would be extracted to a file without
+# an extension (eg: 00000000,00000001)
+# NONE y 1000 FOREMOST
+#
+#---------------------------------------------------------------------
+# GRAPHICS FILES
+#---------------------------------------------------------------------
+#
+#
+# AOL ART files
+# art y 150000 \x4a\x47\x04\x0e \xcf\xc7\xcb
+# art y 150000 \x4a\x47\x03\x0e \xd0\xcb\x00\x00
+#
+# GIF and JPG files (very common)
+# (NOTE THESE FORMATS HAVE BUILTIN EXTRACTION FUNCTION)
+# gif y 155000000 \x47\x49\x46\x38\x37\x61 \x00\x3b
+# gif y 155000000 \x47\x49\x46\x38\x39\x61 \x00\x00\x3b
+# jpg y 20000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9
+# jpg y 20000000 \xff\xd8\xff\xe1 \xff\xd9
+# jpg y 20000000 \xff\xd8 \xff\xd9
+#
+# PNG (used in web pages)
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# png y 200000 \x50\x4e\x47? \xff\xfc\xfd\xfe
+#
+#
+# BMP
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# bmp y 100000 BM??\x00\x00\x00
+#
+# TIF
+# tif y 200000000 \x49\x49\x2a\x00
+#
+#---------------------------------------------------------------------
+# ANIMATION FILES
+#---------------------------------------------------------------------
+#
+# AVI (Windows animation and DiVX/MPEG-4 movies)
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# avi y 4000000 RIFF????AVI
+#
+# Apple Quicktime
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# mov y 4000000 ????????\x6d\x6f\x6f\x76
+# mov y 4000000 ????????\x6d\x64\x61\x74
+#
+# MPEG Video
+# mpg y 4000000 mpg eof
+# mpg y 20000000 \x00\x00\x01\xba \x00\x00\x01\xb9
+# mpg y 20000000 \x00\x00\x01\xb3 \x00\x00\x01\xb7
+#
+# Macromedia Flash
+# fws y 4000000 FWS
+#
+#---------------------------------------------------------------------
+# MICROSOFT OFFICE
+#---------------------------------------------------------------------
+#
+# Word documents
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# doc y 12500000 \xd0\xcf\x11\xe0\xa1\xb1
+#
+# Outlook files
+# pst y 400000000 \x21\x42\x4e\xa5\x6f\xb5\xa6
+# ost y 400000000 \x21\x42\x44\x4e
+#
+# Outlook Express
+# dbx y 4000000 \xcf\xad\x12\xfe\xc5\xfd\x74\x6f
+# idx y 4000000 \x4a\x4d\x46\x39
+# mbx y 4000000 \x4a\x4d\x46\x36
+#
+#---------------------------------------------------------------------
+# WORDPERFECT
+#---------------------------------------------------------------------
+#
+# wpc y 100000 ?WPC
+#
+#---------------------------------------------------------------------
+# HTML (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+#---------------------------------------------------------------------
+#
+# htm n 50000 <html </html>
+#
+#---------------------------------------------------------------------
+# ADOBE PDF (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+#---------------------------------------------------------------------
+#
+# pdf y 5000000 %PDF- %EOF
+#
+#
+#---------------------------------------------------------------------
+# AOL (AMERICA ONLINE)
+#---------------------------------------------------------------------
+#
+# AOL Mailbox
+# mail y 500000 \x41\x4f\x4c\x56\x4d
+#
+#
+#
+#---------------------------------------------------------------------
+# PGP (PRETTY GOOD PRIVACY)
+#---------------------------------------------------------------------
+#
+# PGP Disk Files
+# pgd y 500000 \x50\x47\x50\x64\x4d\x41\x49\x4e\x60\x01
+#
+# Public Key Ring
+# pgp y 100000 \x99\x00
+# Security Ring
+# pgp y 100000 \x95\x01
+# pgp y 100000 \x95\x00
+# Encrypted Data or ASCII armored keys
+# pgp y 100000 \xa6\x00
+# (there should be a trailer for this...)
+# txt y 100000 -----BEGIN\040PGP
+#
+#
+#---------------------------------------------------------------------
+# RPM (Linux package format)
+#---------------------------------------------------------------------
+# rpm y 1000000 \xed\xab
+#
+#
+#---------------------------------------------------------------------
+# SOUND FILES
+#---------------------------------------------------------------------
+# (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
+# wav y 200000 RIFF????WAVE
+#
+# Real Audio Files
+# ra y 1000000 \x2e\x72\x61\xfd
+# ra y 1000000 .RMF
+#
+# asf y 8000000 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C
+#
+# wmv y 20000000 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C
+#
+# wma y 8000000 \x30\x26\xB2\x75 \x00\x00\x00\xFF
+#
+# wma y 8000000 \x30\x26\xB2\x75 \x52\x9A\x12\x46
+#
+# mp3 y 8000000 \xFF\xFB??\x44\x00\x00
+# mp3 y 8000000 \x57\x41\x56\45 \x00\x00\xFF\
+# mp3 y 8000000 \xFF\xFB\xD0\ \xD1\x35\x51\xCC\
+# mp3 y 8000000 \x49\x44\x33\
+# mp3 y 8000000 \x4C\x41\x4D\x45\
+#---------------------------------------------------------------------
+# WINDOWS REGISTRY FILES
+#---------------------------------------------------------------------
+#
+# Windows NT registry
+# dat y 4000000 regf
+# Windows 95 registry
+# dat y 4000000 CREG
+#
+# lnk y 5000 \x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00
+# chm y 100000 \x49\x54\x53\x46\x03\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00
+# cookie n 4096 id=
+# rdp y 4096 \xFF\xFE\x73\x00\x63\x00\x72\x00\x65\x00\x65\x00\x6E\x00\x20\x00\x6D
+#
+#---------------------------------------------------------------------
+# MISCELLANEOUS
+#---------------------------------------------------------------------
+# (NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION)
+# zip y 10000000 PK\x03\x04 \x3c\xac
+# (NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION)
+# rar y 10000000 Rar!
+#
+# java y 1000000 \xca\xfe\xba\xbe
+#
+# cpp y 20000 #include #include ASCII
+#---------------------------------------------------------------------
+# ScanSoft PaperPort "Max" files
+#---------------------------------------------------------------------
+# max y 1000000 \x56\x69\x47\x46\x6b\x1a\x00\x00\x00\x00 \x00\x00\x05\x80\x00\x00
+#---------------------------------------------------------------------
+# PINs Password Manager program
+#---------------------------------------------------------------------
+# pins y 8000 \x50\x49\x4e\x53\x20\x34\x2e\x32\x30\x0d
projects / zenbook / commitdiff