-
Notifications
You must be signed in to change notification settings - Fork 29
/
Copy pathDocDump.ACQ
100 lines (100 loc) · 2.39 KB
/
DocDump.ACQ
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
***************************************************
* Live Document Acquisition Script (2.0) *
* - Pulls Common Media File Types from disk *
* - Created by D0n Quix0te/OMENScan (May 2015) *
***************************************************
SET:CopyPath=Part
SAY:
SAY: * * * Please MAKE SURE you are running this as an Administrator * * *
SAY: * * * Administrator right are required for many of these utilities * * *
SAY:
SAY: AChoir will scan the Hard drive and pull Document Files based on File
SAY: Type AND/OR File signature/Header
SAY:
PZZ: Press Any Key to Continue, or q to QUIT
SAY:
SAY: Step 1. Loading Document File Signatures...
SAY:
Sig:Clear
Sig:DOC=d0cf11e0a1b11ae1
Sig:DOC=0d444f43
Sig:DOC=1234567890ff
Sig:DOC=31be000000ab0000
Sig:DOC=504b0304140000000000
Sig:DOC=7ffe340a
Sig:DOC=cf11e0a1b11ae100
Sig:doc=d0cf11e0a1b1
Sig:DOC=dba52d00
Sig:DOC=eca5c100
Sig:DOCX=504b0304
Sig:DOT=d0cf11e0a1b11ae1
Sig:FDF=255044462525454f46
Sig:ODP=504b0304
Sig:ODT=504b0304
Sig:OTT=504b0304
Sig:PDF=255044462525454f46
Sig:PDF=255044462d312e320d0a25e2e3cf
Sig:PPS=d0cf11e0a1b11ae1
Sig:PPT=006e1ef0
Sig:PPT=0f00e803
Sig:PPT=a0461df0
Sig:PPT=d0cf11e0a1b11ae1
Sig:PPT=fdffffff0e000000
Sig:PPT=fdffffff1c000000
Sig:PPT=fdffffff43000000
Sig:PPTX=504b0304
Sig:RTF=7b5c727466
Sig:WIZ=d0cf11e0a1b11ae1
Sig:WK1=0000020006040600
Sig:WK3=00001a0000100400
Sig:WK4=00001a0002100400
Sig:WK5=00001a0002100400
Sig:WKS=00001a001004
Sig:WKS=0e574b53
Sig:WKS=ff00020004040554
Sig:WP=ff575043
Sig:WP5=ff575043
Sig:WP6=ff575043
Sig:WPD=ff575043
Sig:WPG=ff575043
Sig:WPP=ff575043
Sig:WPS=d0cf11e0a1b11ae1
Sig:WRI=31be
Sig:WRI=32be
Sig:WRI=be000000ab
Sig:XLA=d0cf11e0a1b11ae1
Sig:XLS=0902060000001000b9045c00
Sig:XLS=0904060000001000f6055c00
Sig:XLS=0908100000060500
Sig:XLS=d0cf11e0a1b11ae1
Sig:XLS=fdffffff10
Sig:XLS=fdffffff1f
Sig:XLS=fdffffff22
Sig:XLS=fdffffff23
Sig:XLS=fdffffff28
Sig:XLS=fdffffff29
Sig:XLSX=504b0304
Sig:XML=3c3f786d6c
Sig:XML=3c3f786d6c2076657273696f6e3d22
Sig:XML=fffe3c0052004f004f005400530054
SAY:
SAY: Step 2. Loading Email File Signatures...
SAY:
Sig:dbx=cfad12fec5fd746f
Sig:email=46726F6D3A
Sig:EML=46726f6d
Sig:EML=46726f6d203f3f3f403f3f3f20
Sig:EML=46726f6d3a20
Sig:EML=52657475726e2d50
Sig:EML=582d
Sig:idx=4a4d4639
Sig:mail=414f4c564d
Sig:mbx=4a4d4636
Sig:ost=2142444e
Sig:PST=2142444e
Sig:pst=21424ea56fb5a6
SAY:
SAY: Step 3. Searching for Document and Email Files...
SAY:
ACQ:\Doc-EMail
NCS:"C:\*" "&Acq"