Top Tweets for #CDbank
Este fue el documento que hizo con los resultados del análisis completo de #CDBank:
# CDBank Binary Format - Discoveries
## Files in DB/ directory
- `cd.dat` (120577 bytes) — main catalog, 27 fields per record, **471 disks recovered**
- `files_*.dat` — file listings per disk (variable sizes, e.g. `files_138.dat` 2.8 MB)
- `folders_*.dat` — folder listings per disk
- `specimen.dat` (64 bytes) — specimen/reference data
## File Header Structure (confirmed)
All `.dat` files start with the magic string `Ver333333` (9 bytes ASCII).
| Offset | Size | Description |
|--------|------|-------------|
| 0-8 | 9 | Magic: `Ver333333` |
| 9-10 | 2 | Unknown (bytes `fb 3f`) |
| 11-14 | 4 | Field count (uint32 LE) = 27 for cd.dat |
| 15+ | var | Field definitions |
### Field Definition Structure (per field, starting at offset 15)
| Size | Field |
|------|-------|
| 4 | Width (uint32 LE) — max field width |
| 2 | Type code (uint16 LE) |
| 2 | Name length (uint16 LE, includes null terminator) |
| N | Field name (ASCII, null-terminated) |
Total header size: 482 bytes for cd.dat (27 fields). Data starts at offset 482.
### Field Definitions for cd.dat (27 fields)
|| # | Name | Width | Code |
||---|------|-------|------|
|| 0 | Id | 4 | 3 |
|| 1 | Volume_Label | 21 | 1 |
|| 2 | Name | 256 | 1 |
|| 3 | Heading_ID | 4 | 3 |
|| 4 | CD_SN | 4 | 3 |
|| 5 | File_System | 9 | 1 |
|| 6 | Descript | 0 | 14 |
|| 7 | Loading_Date | 4 | 9 |
|| 8 | Used_Size | 8 | 21 |
|| 9 | Free_Space | 8 | 21 |
|| 10 | FoldersCount | 4 | 3 |
|| 11 | CDType | 4 | 3 |
|| 12 | HaveTags | 4 | 3 |
|| 13 | DriveL | 4 | 3 |
|| 14 | HaveBodies | 4 | 3 |
|| 15 | Last_Modify | 8 | 11 |
|| 16 | Cover_Image_FN | 51 | 1 |
|| 17 | Location_ID | 4 | 3 |
|| 18 | Adding_Mode | 4 | 3 |
|| 19 | Barcode | 51 | 1 |
|| 20 | Price | 8 | 6 |
|| 21 | CDDB_ID | 8 | 21 |
|| 22 | Track_Count | 4 | 3 |
|| 23 | PreSize | 8 | 21 |
|| 24 | Code | 256 | 1 |
|| 25 | CodeFlag | 4 | 3 |
|| 26 | GID | 51 | 1 |
## Binary Record Encoding (CONFIRMED byte-by-byte)
### Type codes → storage format
| Code | Meaning | Storage |
|------|---------|---------|
| 3 | nullable int32 | `flag(1) + int32(4)` — flag=1 means present, flag=0 means NULL |
| 1 | varchar (non-nullable) | `len(4 LE) + data(len)` — includes null terminator in len |
| 14 | longtext/blob (non-nullable) | `len(4 LE) + data(len)` — same as code 1 |
| 9 | nullable date (ordinal) | `flag(1) + uint32(4)` — days since 0001-01-01 (Delphi TDate) |
| 11 | nullable datetime (.NET ticks) | `flag(1) + double(8)` — microseconds since 0001-01-01 (confirmed: Id 1 → modificado 2006-02-26) |
| 6 | nullable double | `flag(1) + double(8)` |
| 21 | nullable int64 | `flag(1) + int64(8)` |
### Key findings
- **Width in header ≠ storage size.** Width is the max declared size; actual storage depends on the type code.
- **Code 14 (Description, Comment)** uses `length(4) + data` WITHOUT a nullable flag — confirmed from byte trace where `39000000` = length 57 bytes of text.
- **Code 3 (int32)** uses `flag(1) + value(4)` — flag=1 → present, flag=0 → NULL.
- **Code 9 (date)** uses `flag(1) + ordinal(4)` — Delphi/Pascal TDateTime base: `https://t.co/5vNqMeHQg2(1, 1, 1) + timedelta(days=ordinal)`.
- **Code 11 (datetime double)** uses `flag(1) + double(8)` — base .NET ticks: microseconds since 0001-01-01. Confirmed: Id 1 `Last_Modify` → 2006-02-26 (matches `Loading_Date` 25/02/2006 in its description).
## First Record Trace (offset 482+)
| Field | Bytes | Value |
|-------|-------|-------|
| Id | `01 01000000` | flag=1, value=1 |
| Volume_Label | `0a000000 NETT-APP4\0` | "NETT-APP4" |
| Heading_ID | `01000000` | code 3, flag=0 → NULL |
| File_System | `05000000 CDFS\0` | "CDFS" |
| CD_SN | `01 8cb7ac3e` | flag=1, value=1051506572 |
| Name | `0a000000 NETT-APP4\0` | "NETT-APP4" |
| Folder | `01000000` | code 3, flag=0 → NULL |
| Description | `39000000 disco NETT-APP4...` | "disco NETT-APP4 \r\n cargado en la base 25/02/2006\r\n-------..." |
| Loading_Date | `cf2c0b00` | ordinal=732367 → 2006-02-25 |
| Free_Size | `a0df2b00` | 2,875,296 (bytes? sectors?) |
| Used_Size | `00000000 00000000` | 0 |
| File_Count | `01 9d000000` | flag=1, value=157 |
| Folder_Count | `01 02000000` | flag=1, value=2 |
| Track | `01 00000000` | flag=1, value=0 |
| Comment | `01 44000000` | flag=1, length=68 |
| Author | `00000000` | length=0 → empty |
| Last_Modified | `01 804df2eb 5ac6cc42` | double → datetime |
| File1..File10 | various | code 1 strings |
## Encoding & Delphi/BDE notes
- Application is Delphi/VCL (Turbo C `__linker` string, Borland BDE)
- Encoding: **cp1252** (Latin-1 Windows, Spanish/Castellano as set in Cdbank.ini)
- BDE (Borland Database Engine) needed for Paradox/dBASE tables
- `Cdbank.ini`: `Language=Spanish - Castellano`
- Wine attempt failed with "Protection Error" (missing BDE/IDAPI32.DLL)
## Sub-files (files_*.dat / folders_*.dat) — parsed
- `files_*.dat` — file listings per disk; `folders_*.dat` — folder listings per disk. The numeric suffix (`files_138.dat`) is the **disk Id** from `cd.dat`, so the hierarchy is `disk → folders → files`.
- These use the same header/encoding scheme. Records parse sequentially with a fixed per-record layout (no anchors needed).
- `specimen.dat` (64 bytes) — specimen/reference data, not a catalog table.
## Parser script location
`extract_cdbank.py` (project root) — Python parser implementing the format above. Run it **from the project root** (`python3 extract_cdbank.py`); it resolves paths from its own location, reads `.dat` from `CDBank/DB/` and writes to `extracted/`.
## Output format
- CSV + JSON mirror per `.dat` file in `extracted/` (project root, next to the script)
- Encoding: UTF-8 output from cp1252 input
## Results (recovered)
| Output | Records |
|--------|---------|
| `cd.csv` / `cd.json` (main catalog) | **471 disks** |
| `files_*.csv`/`.json` | 304 416 file entries |
| `folders_*.csv`/`.json` | 24 124 folder entries |
| **Grand total** | **329 011 records** |
Hierarchy integrity: every sub-file maps to a disk Id, and every disk Id has its sub-files (0 orphan sub-files, 0 disks without content).
Record-validation rule (final, confirmed): broad validity — `File_System` in known list, `Id` plausible (1–1000), `Loading_Date` in plausible range (2000–2025). The strict `Name == Volume_Label` anchor was too restrictive and discarded 98 renamed disks; the broad check recovers all **471**.
🧐 Dirán que ya, chole, pero va un #FunFact: ¿Vieron que los leaks de @Pemex son los más vistos en el sitio de #doppleleaks? En este momento tiene 163 vistas, por encima de los #leaks de la banca en línea #CDBank (ojo #fintech mexicanas) con 141 vistas. #DoppelPaymer #ransomware
Monday 18th of June. Save the date!! RESPECT...
Children @stasou1 women #AndreasStavroulis time @AS7RAS @Karaiskakio #cdbank
Ceyda Düvenci imza etkinliğine hazırız ☺
6 Şubat Cumartesi (bugün) Ceyda Düvenci #CDbank'ta David People Bursa... https://t.co/jcMhilksNH
*** TODAY FROM BURSA !!! ❤️Gorgeous smile !!!!!!! ❤️😀😍#HalitErgenc #halitergenç #bursa #cdbank… https://t.co/61v01vrw8B
*** TODAY FROM BURSA !!! ❤️Gorgeous smile !!!!!!! ❤️😀😍#HalitErgenc #halitergenç #bursa #cdbank… https://t.co/61v01vrw8B
Halit in CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank #interiordesign… http://t.co/EtATbdhN41
Halit in CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank #interiordesign… http://t.co/Q4Kmb2nv1l
Halit with Said Şahin from CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank… http://t.co/000mz1eKJs
Last Seen Hashtags on Sotwe
ทอมอยากลองควย
Seen from Thailand
machika
Seen from Mexico
JennaOrtega
Seen from Mexico
KeremBürsin
Seen from Turkey
bulansutena
Seen from Indonesia
ควยตำรวจ
Seen from Thailand
นัดเย็ดบางปลา
Seen from Thailand
fuck mms
Seen from France
TheFantasieOfAStepmother
Seen from United States
ijtpk
Seen from United States
Most Popular Users
Elon Musk 
@elonmusk
241M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers