QBW Signature format

QBW Signature Format: Specification & Recovery Example

Intuit QuickBooks QBW data files have a signature MAUI (characters 'M','A','U', 'I' or bytes 0x4D, 0x41, 0x55, 0x49) at the offset 96 (0x60). At offset 52 (0x34) located total number of blocks in a file minus one, 4 bytes, little-endian order (lowest byte first).

At offset 36 (0x24) located number of data blocks minus one, 4 bytes, little-endian order (lowest byte first). Block size is always 1024 bytes. File size is calculated as total number of blocks multiplied by block size.

When inspecting file's binary data using any Hex Viewer, like Active@ Disk Editor we can see the signature MAUI (hex: 4D 41 55 49) at offset 96 (0x60). Total number of data blocks (minus one) is 3,422 (hex: 5E 0D 00 00 at offset 52 (0x34)).

QBW file size is 3,505,152 bytes: 1,024 * (3,422+1).

Thus reading of all 3,505,152 consecutive bytes starting from the sector where MAUI signature has been detected provide us with all QBW file data.

Active@ File Recovery Custom Scripting Example

This example does some validation calculations for QBW header's parameters beyond simple file size extraction. Syntax of the signature definition language you can read here.

[QBW_HEADER]
DESCRIPTION=QuickBooks Data File
EXTENSION=qbw
BEGIN=QBW_BEGIN
SCRIPT=QBW_SCRIPT

[QBW_BEGIN]
MAUI=96|96

[QBW_SCRIPT]
    data = read(dword, 36)
    temp = read(dword, 52)
    if (temp <= data) goto exit
    size = sum(temp, 1)
    size = shl(size, 10)