Top Tweets for #cdbank
Este fue el documento que hizo con los resultados del análisis completo de #CDBank:
# CDBank Binary Format - Discoveries
## Files in DB/ directory
- `cd.dat` (120577 bytes) — main catalog, 27 fields per record, **471 disks recovered**
- `files_*.dat` — file listings per disk (variable sizes, e.g. `files_138.dat` 2.8 MB)
- `folders_*.dat` — folder listings per disk
- `specimen.dat` (64 bytes) — specimen/reference data
## File Header Structure (confirmed)
All `.dat` files start with the magic string `Ver333333` (9 bytes ASCII).
| Offset | Size | Description |
|--------|------|-------------|
| 0-8 | 9 | Magic: `Ver333333` |
| 9-10 | 2 | Unknown (bytes `fb 3f`) |
| 11-14 | 4 | Field count (uint32 LE) = 27 for cd.dat |
| 15+ | var | Field definitions |
### Field Definition Structure (per field, starting at offset 15)
| Size | Field |
|------|-------|
| 4 | Width (uint32 LE) — max field width |
| 2 | Type code (uint16 LE) |
| 2 | Name length (uint16 LE, includes null terminator) |
| N | Field name (ASCII, null-terminated) |
Total header size: 482 bytes for cd.dat (27 fields). Data starts at offset 482.
### Field Definitions for cd.dat (27 fields)
|| # | Name | Width | Code |
||---|------|-------|------|
|| 0 | Id | 4 | 3 |
|| 1 | Volume_Label | 21 | 1 |
|| 2 | Name | 256 | 1 |
|| 3 | Heading_ID | 4 | 3 |
|| 4 | CD_SN | 4 | 3 |
|| 5 | File_System | 9 | 1 |
|| 6 | Descript | 0 | 14 |
|| 7 | Loading_Date | 4 | 9 |
|| 8 | Used_Size | 8 | 21 |
|| 9 | Free_Space | 8 | 21 |
|| 10 | FoldersCount | 4 | 3 |
|| 11 | CDType | 4 | 3 |
|| 12 | HaveTags | 4 | 3 |
|| 13 | DriveL | 4 | 3 |
|| 14 | HaveBodies | 4 | 3 |
|| 15 | Last_Modify | 8 | 11 |
|| 16 | Cover_Image_FN | 51 | 1 |
|| 17 | Location_ID | 4 | 3 |
|| 18 | Adding_Mode | 4 | 3 |
|| 19 | Barcode | 51 | 1 |
|| 20 | Price | 8 | 6 |
|| 21 | CDDB_ID | 8 | 21 |
|| 22 | Track_Count | 4 | 3 |
|| 23 | PreSize | 8 | 21 |
|| 24 | Code | 256 | 1 |
|| 25 | CodeFlag | 4 | 3 |
|| 26 | GID | 51 | 1 |
## Binary Record Encoding (CONFIRMED byte-by-byte)
### Type codes → storage format
| Code | Meaning | Storage |
|------|---------|---------|
| 3 | nullable int32 | `flag(1) + int32(4)` — flag=1 means present, flag=0 means NULL |
| 1 | varchar (non-nullable) | `len(4 LE) + data(len)` — includes null terminator in len |
| 14 | longtext/blob (non-nullable) | `len(4 LE) + data(len)` — same as code 1 |
| 9 | nullable date (ordinal) | `flag(1) + uint32(4)` — days since 0001-01-01 (Delphi TDate) |
| 11 | nullable datetime (.NET ticks) | `flag(1) + double(8)` — microseconds since 0001-01-01 (confirmed: Id 1 → modificado 2006-02-26) |
| 6 | nullable double | `flag(1) + double(8)` |
| 21 | nullable int64 | `flag(1) + int64(8)` |
### Key findings
- **Width in header ≠ storage size.** Width is the max declared size; actual storage depends on the type code.
- **Code 14 (Description, Comment)** uses `length(4) + data` WITHOUT a nullable flag — confirmed from byte trace where `39000000` = length 57 bytes of text.
- **Code 3 (int32)** uses `flag(1) + value(4)` — flag=1 → present, flag=0 → NULL.
- **Code 9 (date)** uses `flag(1) + ordinal(4)` — Delphi/Pascal TDateTime base: `https://t.co/5vNqMeHQg2(1, 1, 1) + timedelta(days=ordinal)`.
- **Code 11 (datetime double)** uses `flag(1) + double(8)` — base .NET ticks: microseconds since 0001-01-01. Confirmed: Id 1 `Last_Modify` → 2006-02-26 (matches `Loading_Date` 25/02/2006 in its description).
## First Record Trace (offset 482+)
| Field | Bytes | Value |
|-------|-------|-------|
| Id | `01 01000000` | flag=1, value=1 |
| Volume_Label | `0a000000 NETT-APP4\0` | "NETT-APP4" |
| Heading_ID | `01000000` | code 3, flag=0 → NULL |
| File_System | `05000000 CDFS\0` | "CDFS" |
| CD_SN | `01 8cb7ac3e` | flag=1, value=1051506572 |
| Name | `0a000000 NETT-APP4\0` | "NETT-APP4" |
| Folder | `01000000` | code 3, flag=0 → NULL |
| Description | `39000000 disco NETT-APP4...` | "disco NETT-APP4 \r\n cargado en la base 25/02/2006\r\n-------..." |
| Loading_Date | `cf2c0b00` | ordinal=732367 → 2006-02-25 |
| Free_Size | `a0df2b00` | 2,875,296 (bytes? sectors?) |
| Used_Size | `00000000 00000000` | 0 |
| File_Count | `01 9d000000` | flag=1, value=157 |
| Folder_Count | `01 02000000` | flag=1, value=2 |
| Track | `01 00000000` | flag=1, value=0 |
| Comment | `01 44000000` | flag=1, length=68 |
| Author | `00000000` | length=0 → empty |
| Last_Modified | `01 804df2eb 5ac6cc42` | double → datetime |
| File1..File10 | various | code 1 strings |
## Encoding & Delphi/BDE notes
- Application is Delphi/VCL (Turbo C `__linker` string, Borland BDE)
- Encoding: **cp1252** (Latin-1 Windows, Spanish/Castellano as set in Cdbank.ini)
- BDE (Borland Database Engine) needed for Paradox/dBASE tables
- `Cdbank.ini`: `Language=Spanish - Castellano`
- Wine attempt failed with "Protection Error" (missing BDE/IDAPI32.DLL)
## Sub-files (files_*.dat / folders_*.dat) — parsed
- `files_*.dat` — file listings per disk; `folders_*.dat` — folder listings per disk. The numeric suffix (`files_138.dat`) is the **disk Id** from `cd.dat`, so the hierarchy is `disk → folders → files`.
- These use the same header/encoding scheme. Records parse sequentially with a fixed per-record layout (no anchors needed).
- `specimen.dat` (64 bytes) — specimen/reference data, not a catalog table.
## Parser script location
`extract_cdbank.py` (project root) — Python parser implementing the format above. Run it **from the project root** (`python3 extract_cdbank.py`); it resolves paths from its own location, reads `.dat` from `CDBank/DB/` and writes to `extracted/`.
## Output format
- CSV + JSON mirror per `.dat` file in `extracted/` (project root, next to the script)
- Encoding: UTF-8 output from cp1252 input
## Results (recovered)
| Output | Records |
|--------|---------|
| `cd.csv` / `cd.json` (main catalog) | **471 disks** |
| `files_*.csv`/`.json` | 304 416 file entries |
| `folders_*.csv`/`.json` | 24 124 folder entries |
| **Grand total** | **329 011 records** |
Hierarchy integrity: every sub-file maps to a disk Id, and every disk Id has its sub-files (0 orphan sub-files, 0 disks without content).
Record-validation rule (final, confirmed): broad validity — `File_System` in known list, `Id` plausible (1–1000), `Loading_Date` in plausible range (2000–2025). The strict `Name == Volume_Label` anchor was too restrictive and discarded 98 renamed disks; the broad check recovers all **471**.
🧐 Dirán que ya, chole, pero va un #FunFact: ¿Vieron que los leaks de @Pemex son los más vistos en el sitio de #doppleleaks? En este momento tiene 163 vistas, por encima de los #leaks de la banca en línea #CDBank (ojo #fintech mexicanas) con 141 vistas. #DoppelPaymer #ransomware
Monday 18th of June. Save the date!! RESPECT...
Children @stasou1 women #AndreasStavroulis time @AS7RAS @Karaiskakio #cdbank
Ceyda Düvenci imza etkinliğine hazırız ☺
6 Şubat Cumartesi (bugün) Ceyda Düvenci #CDbank'ta David People Bursa... https://t.co/jcMhilksNH
*** TODAY FROM BURSA !!! ❤️Gorgeous smile !!!!!!! ❤️😀😍#HalitErgenc #halitergenç #bursa #cdbank… https://t.co/61v01vrw8B
*** TODAY FROM BURSA !!! ❤️Gorgeous smile !!!!!!! ❤️😀😍#HalitErgenc #halitergenç #bursa #cdbank… https://t.co/61v01vrw8B
Halit in CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank #interiordesign… http://t.co/EtATbdhN41
Halit in CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank #interiordesign… http://t.co/Q4Kmb2nv1l
Halit with Said Şahin from CD Bank Bursa!!!!!!!!! #halitergenc #HalitErgenç #bursa #hifial #cdbank… http://t.co/000mz1eKJs
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
241.2M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers