File Recovery

QBW Signature format

How to erase hard drive? Windows7 logo   How to erase hard drive? Intel logo

User's guide:

QBW Signature Format: Specification & Recovery Example

Intuit QuickBooks QBW data files have a signature MAUI (characters 'M','A','U', 'I' or bytes 0x4D, 0x41, 0x55, 0x49) at the offset 96 (0x60). At offset 52 (0x34) located total number of blocks in a file minus one, 4 bytes, little-endian order (lowest byte first).

At offset 36 (0x24) located number of data blocks minus one, 4 bytes, little-endian order (lowest byte first). Block size is always 1024 bytes. File size is calculated as total number of blocks multiplied by block size.

When inspecting file's binary data using any Hex Viewer, like Active@ Disk Editor we can see the signature MAUI (hex: 4D 41 55 49) at offset 96 (0x60). Total number of data blocks (minus one) is 3,422 (hex: 5E 0D 00 00 at offset 52 (0x34)).

QBW file size is 3,505,152 bytes: 1,024 * (3,422+1).

Thus reading of all 3,505,152 consecutive bytes starting from the sector where MAUI signature has been detected provide us with all QBW file data.

QBW Signature inspection

Active@ File Recovery Custom Scripting Example

This example does some validation calculations for QBW header's parameters beyond simple file size extraction. Syntax of the signature definition language you can read here.

DESCRIPTION=QuickBooks Data File


    data = read(dword, 36)
    temp = read(dword, 52)
    if (temp <= data) goto exit
    size = sum(temp, 1)
    size = shl(size, 10)

This document is available in PDF format,
which requires Adobe® Acrobat® Reader
(Free download):


Data Recovery

Data Utility

Data Security

Data Backup

CD/DVD Tools