Magic numbers for keyring files?

Robert J. Hansen rjh at sixdemonbag.org
Wed Sep 25 15:18:23 CEST 2013


I'm working on adding support for GnuPG keyrings to a file carver (a
forensic tool that recovers data from damaged filesystems, or recovers
things that have been deleted but not overwritten).  Detecting an
ASCII-armored keyblock is pretty easy: look for the "BEGIN PGP PUBLIC"
header.  Binary, though, is still an unsolved question.

Before I start diving into code to find out if the keyring has a
specific binary header I can detect, I figured I'd ask on-list.  :)

Does anyone know of any magic numbers for GnuPG keyring files?



More information about the Gnupg-users mailing list