2007.07.02 18:56 "Re: [Tiff] Old corrupted TIFF data - "Can not read directory count"", by Kevin Myers

This may sound stupid, and I don't specifically know of any formats like this, but could some of these files actually be separate parts (tiles or pages) of a larger overall composite image file, and each of these offsets are pointing to a directory near the beginning of the next portion of the file?

Just grasping...

Kevin M.

This file is 16822272 bytes in size. The field points to 16823130, just past it (858 bytes).

Some of the other files I've looked at basically the same pattern as below, with different (wrong) values for that offset. For example, I've got one here that's 17149952 bytes in size and has offset pointer 84B20501, which translates to 17150596 - again, just past the end of the file (644 bytes).

What is your file size on disk? Are you reading the bytes backwards? The 4 bytes that you gave below only indicate a 16 MB offset (Intel hex 01 00 b3 5a), so that could easily be realistic...

HTH,

I've got a bunch of TIFF files created back in 1998, which I find I can't read any more. The error from libtiff is "Can not read directory count" and I haven't been able to rebuild whatever old library these were made with, so now I'm looking at the file format trying to work out what went wrong. If any of you can help me along that'd be much appreciated!

I've attached the first few rows of a hex dump at the bottom of this email. Here's what I've puzzled out about the data so far:

49 49 2A 00 - The usual first four bytes

5A B3 00 01 - Should be the directory offset? Can't be valid, though,
               because it points past the end of the file. I haven't
               been able to figure out what else this might identify.

Date string - the last byte is zero so I assume it's written out with

               null termination. This is the date the image was created,
               as best I remember.

60 09 00 00 - no idea what all this is
01 00 00 00
60 09 00 00
01 00 00 00
08 00 08 00

(then it trails off into less regular stuff)

Does this form suggest anything to anybody? I think these files were created on Linux using libtiff (around version 3.5.5) but I'm not sure of it. They might also have come from PaintShopPro as I was still using that for some work back then.

The actual hex dump, first 64 bytes:

49 49 2a 00 5a b3 00 01  31 39 39 38 3a 31 32 3a  |II*.Z...1998:12:|
31 38 20 30 36 3a 32 35  3a 35 36 00 60 09 00 00  |18 06:25:56.`...|
01 00 00 00 60 09 00 00  01 00 00 00 08 00 08 00  |....`...........|
08 00 ba 08 00 00 72 d1  00 00 af 97 01 00 c5 62  |......r........b|

Thanks for any help!

--
Steve Bougerolle <steveb@sebgitech.com>
http://www.sebgitech.com
http://www.bougerolle.net