From 57d41b7b8fc3c4adc9389ae0a1df4dcebea7dac8 Mon Sep 17 00:00:00 2001 From: RedHare-Exe Date: Fri, 23 Jan 2026 17:07:48 -0500 Subject: [PATCH] Added support for Windows Recycling Bin $I files --- README.md | 1 + patterns/ifile.hexpat | 36 ++++++++++++++++++++++++++ tests/patterns/test_data/ifile.hexpat | Bin 0 -> 82 bytes 3 files changed, 37 insertions(+) create mode 100644 patterns/ifile.hexpat create mode 100644 tests/patterns/test_data/ifile.hexpat diff --git a/README.md b/README.md index ccd8378b..42f39d93 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ Everything will immediately show up in ImHex's Content Store and gets bundled wi | Name | MIME | Path | Description | |------|------|------|-------------| +| $I | | [`patterns/ifile.hexpat`](patterns/ifile.hexpat) | Windows Recycling Bin $I file | | 3DS | | [`patterns/3ds.hexpat`](patterns/3ds.hexpat) | Autodesk 3DS Max Model file | | 7Z | | [`patterns/7z.hexpat`](patterns/7z.hexpat) | 7z File Format | | ADTFDAT | | [`patterns/adtfdat.hexpat`](patterns/adtfdat.hexpat) | [ADTFDAT files](https://digitalwerk.gitlab.io/solutions/adtf_content/adtf_base/adtf_file_library) | diff --git a/patterns/ifile.hexpat b/patterns/ifile.hexpat new file mode 100644 index 00000000..36da3c4d --- /dev/null +++ b/patterns/ifile.hexpat @@ -0,0 +1,36 @@ +#pragma author RedHare-Exe +#pragma description Windows Recycling Bin $I file +#pragma magic [ 02 00 00 00 00 00 00 00 ] @ 0x00 + +import std.time; +import type.time; +import std.string; + +using NullString16 = std::string::NullString16; + +struct DelTime { + u64 raw; +} [[format_read("parse_filetime")]]; + +fn parse_filetime(DelTime raw_ft) { + // Convert raw FILETIME to Unix time + u64 unix_time = type::impl::format_filetime_as_unix(raw_ft.raw); + + // Convert Unix time to structured UTC time + std::time::Time ts = std::time::to_utc(unix_time); + + // Format as string + str formatted = std::time::format(ts, "%Y-%m-%d %H:%M:%S"); + + return formatted; +}; + +struct IFile { + u64 Version; + u64 Size; + DelTime DelTime [[name("Deleted Time")]]; + u32 NameSize [[name("Size of Path in Characters")]]; + NullString16 Path; +}; + +IFile IFile @ 0x00; \ No newline at end of file diff --git a/tests/patterns/test_data/ifile.hexpat b/tests/patterns/test_data/ifile.hexpat new file mode 100644 index 0000000000000000000000000000000000000000..b0e2e61e288ca44cfb0f4217b77e8c3879bb1337 GIT binary patch literal 82 zcmZQ#fB+X}2)%(r+i!Ev9Y!M{*O|eJA%-E8p_n0+p$JIEFqA^sF$|duX+WF