# Foremost configuration file
#-------------------------------------------------------------------------
# Note the foremost configuration file is provided to support formats which
# don't have built-in extraction functions.  If the format is built-in to foremost
# simply run foremost with -t <suffix> and provide the format you wish to extract.
#
# The configuration file is used to control what types of files foremost
# searches for. A sample configuration file, foremost.conf, is included with
# this distribution. For each file type, the configuration file describes
# the file's extension, whether the header and footer are case sensitive,
# the maximum file size, and the header and footer for the file. The footer
# field is optional, but header, size, case sensitivity, and extension are
# not!
#
# Any line that begins with a '#' is considered a comment and ignored. Thus,
# to skip a file type just put a '#' at the beginning of that line
#

# Headers and footers are decoded before use. To specify a value in
# hexadecimal use \x[0-f][0-f], and for octal use \[0-3][0-7][0-7].  Spaces
# can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".
#
# To match any single character (aka a wildcard) use a '?'. If you need to
# search for the '?' character, you will need to change the 'wildcard' line
# *and* every occurrence of the old wildcard character in the configuration
# file. Don't forget those hex and octal values! '?' is equal to 0x3f and
# \063.
#
# If you would like to extract files without an extension enter the value
# "NONE" in the extension column (note: you can change the value of this
# "no suffix" flag by setting the variable FOREMOST_NOEXTENSION_SUFFIX
# in foremost.h and recompiling).
#
# The ASCII option will extract all ASCII printable characters before and after
# the keyword provided.
#
# The NEXT keyword after a footer instructs foremost to search forwards for data
# that starts with the header provided and terminates or is followed by data in
# the footer -- the footer data is not included in the output.  The data in the
# footer, when used with the NEXT keyword effectively allows you to search for
# data that you know for sure should not be in the output file.  This method for
# example, lets you search for two 'starting' headers in a document that doesn't
# have a good ending footer and you can't say exactly what the footer is, but
# you know if you see another header, that should end the search and an output
# file should be written.

# To redefine the wildcard character, change the setting below and all
# occurances in the formost.conf file.
#
#wildcard  ?
#
#               case    size    header                  footer
#extension   sensitive
#
#---------------------------------------------------------------------
# EXAMPLE WITH NO SUFFIX
#---------------------------------------------------------------------
#
# Here is an example of how to use the no extension option. Any files
# containing the string "FOREMOST" would be extracted to a file without
# an extension (eg: 00000000,00000001)
#      NONE     y      1000     FOREMOST
#
#---------------------------------------------------------------------
# GRAPHICS FILES
#---------------------------------------------------------------------
#
        vmdk    y       200000000000 \x56\x4d\x44\x4b      //this is how im trying to do



# GIF and JPG files (very common)
#       (NOTE THESE FORMATS HAVE BUILTIN EXTRACTION FUNCTION)
#       gif     y       155000000       \x47\x49\x46\x38\x37\x61        \x00\x3b
#       gif     y       155000000       \x47\x49\x46\x38\x39\x61        \x00\x00\x3b
#       jpg     y       20000000        \xff\xd8\xff\xe0\x00\x10        \xff\xd9
#       jpg     y       20000000        \xff\xd8\xff\xe1 \xff\xd9
#       jpg     y       20000000        \xff\xd8        \xff\xd9
#
# PNG   (used in web pages)
#       (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#       png     y       200000  \x50\x4e\x47?   \xff\xfc\xfd\xfe
#
#
# BMP
#       (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#       bmp     y       100000  BM??\x00\x00\x00
#
# TIF
#       tif     y       200000000       \x49\x49\x2a\x00
#
#---------------------------------------------------------------------
# ANIMATION FILES
#---------------------------------------------------------------------
#
# AVI (Windows animation and DiVX/MPEG-4 movies)
#       (NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#       avi     y       4000000 RIFF????AVI