1

I am trying to extract data from a proprietary file type: .take. I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other files. Refer to the following Google Drive "preview". I guess the file has some sort of MIME metadata so Drive can figure out it's contents, but I can't open it with any unzip programs!

enter image description here

From the looks of this, this file contains some very common file formats (XML, videos, pictures, protobuf). I need to extract these files, but cannot download them directly! The only application I can open the file in is a text editor, and when I do the data is neatly organized in 32-bit chunks. Possible FourCC identification?

enter image description here

I can obviously write a script to read this data in but I am unsure of even the encoding! What suggestions or techniques might I employ to extract the files? . Can I leverage the fact that I know the details of the compressed files?

Download the file here: http://www.filehosting.org/file/details/666710/QkDRIV0yPMo9llWF/file.take

Improve this question
4
  • Possible duplicate of Where to find information about a file format?
    – julian ♦
    Commented May 19, 2017 at 16:33
  • Great link, some good ideas there! I know quite a bit about this file, however, perhaps most unusually that it is a compressed set of more conventional files (the other question doesn't discuss de-compression at all). Definitely unique enough to warrant it's own question.
    – David Ferris
    Commented May 19, 2017 at 16:55
  • 1
    The google drive preview is pretty much the only clue I have - I've posted a download link for the file.
    – David Ferris
    Commented May 19, 2017 at 18:34
  • This is how sublime displays binary content, can be deceiving, try using a different tool like HxD or Total Commanders Inspect function (F3).
    – Dominik Antal
    Commented May 27, 2017 at 7:32

2 Answers 2

Reset to default
1

Fortunately, file extraction is trivial in this case. binwalk can be used to extract all of the files.

An entropy plot produced by binwalk -E -J file.take reveals that some files within file.take are not compressed.

files in file.take revealed by entropy plot

A signature scan performed via binwalk file.take reveals that file.take contains multiple Zip archives:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 3171, uncompressed size: 3171, name: Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf
3289          0xCD9           Zip archive data, at least v2.0 to extract, compressed size: 364, uncompressed size: 364, name: Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf
3771          0xEBB           Zip archive data, at least v2.0 to extract, compressed size: 428064, uncompressed size: 428064, name: Bryan Potter - 2017 04 26 110613-forceplate.pbuf
431949        0x6974D         Zip archive data, at least v2.0 to extract, compressed size: 8760940, uncompressed size: 8760940, name: Bryan Potter - 2017 04 26 110613-pressure.pbuf
9193001       0x8C4629        Zip archive data, at least v2.0 to extract, compressed size: 7138962, uncompressed size: 7138962, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi
16332095      0xF9353F        Zip archive data, at least v2.0 to extract, compressed size: 8412, uncompressed size: 8412, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg
16340639      0xF9569F        Zip archive data, at least v2.0 to extract, compressed size: 13693928, uncompressed size: 13693928, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi
30034699      0x1CA4B0B       Zip archive data, at least v2.0 to extract, compressed size: 6096, uncompressed size: 6096, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg
30040927      0x1CA635F       Zip archive data, at least v2.0 to extract, compressed size: 5483, uncompressed size: 5483, name: data.xml
30047692      0x1CA7DCC       End of Zip archive, footer length: 22


Extraction performed via binwalk -e file.take has the following results:

total 58792
drwxr-xr-x 2 user01 user01     4096 May 19 14:43 ./
drwxr-xr-x 3 user01 user01     4096 May 19 14:43 ../
-rw-r--r-- 1 user01 user01 30047714 May 19 14:43 0.zip
-rw-r--r-- 1 user01 user01     3171 May  3 07:24 Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf
-rw-r--r-- 1 user01 user01      364 May  3 07:24 Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf
-rw-r--r-- 1 user01 user01   428064 Apr 26 11:06 Bryan Potter - 2017 04 26 110613-forceplate.pbuf
-rw-r--r-- 1 user01 user01  8760940 Apr 26 11:06 Bryan Potter - 2017 04 26 110613-pressure.pbuf
-rw-r--r-- 1 user01 user01  7138962 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi
-rw-r--r-- 1 user01 user01     8412 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg
-rw-r--r-- 1 user01 user01 13693928 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi
-rw-r--r-- 1 user01 user01     6096 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg
-rw-r--r-- 1 user01 user01     5483 May  3 07:24 data.xml


enter image description here extracted pic 1

<?xml version="1.0"?>
<Take>
  <ExporterVersion>10</ExporterVersion>
  <Id>1458</Id>
  <Rating>Unrated</Rating>
  <Date>636288015738944466</Date>
  <Comment xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />
  <SportID>Golf</SportID>
  <OnlineID>0</OnlineID>
  <Club>
    <Type>Iron</Type>
    <Name>8 Iron</Name>
  </Club>
  <Session>
    <Name xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />
    <DateTicks>636288009579666379</DateTicks>
  </Session>
  <StudentData>
    <Firstname>Bryan</Firstname>
    <Lastname>Potter</Lastname>
    <BirthYear xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />
    <Address xsi:nil="true" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />

<- snip ->


And so on and so forth...

Improve this answer
2
  • This is so awesome!!! So there were just a few zipped files concatenated on each other?
    – David Ferris
    Commented May 19, 2017 at 20:18
  • @DavidFerris looks that way
    – julian ♦
    Commented May 19, 2017 at 20:23
1

There is nothing special about this file. It's just a ZIP archive.

header

See that 50 4B 03 04? The PK is a dead giveaway when you take a peak. This is the "magic number" identifier for a ZIP archive.

Your standard unzip will work fine:

~/Downloads » unzip file.take
Archive:  file.take
 extracting: Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf
 extracting: Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf
 extracting: Bryan Potter - 2017 04 26 110613-forceplate.pbuf
 extracting: Bryan Potter - 2017 04 26 110613-pressure.pbuf
 extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi
 extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg
 extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi
 extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg
 extracting: data.xml

The binwalk @SYS_V ran said as much, it just wasn't very clear about it. It mentions finding the footer and just assumes you understand what that means.

30047692      0x1CA7DCC       End of Zip archive, footer length: 22
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.