ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "GSM" and "File Format Identification"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
m (formatting Bibliographies)
 
Line 1: Line 1:
[http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=18 cheap diazepam] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=312 cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=45 nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=285 qwest ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=79 zanaflex online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=247 diazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=305 verizon ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226682379944.html free motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/318.html order lortab] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=62 prozac online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=21 ericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/330.html but ortho] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,19 cheap cyclobenzaprine] [http://climate.msrc.sunysb.edu/1984/messages/295.html cheap celexa] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=253 free ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=49 phentermine] [http://climate.msrc.sunysb.edu/1984/messages/300.html free cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=52 cheap prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,44 free qwest ringtones] [http://climate.msrc.sunysb.edu/1984/messages/296.html cialis online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=297 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=60 nexium online] [http://climate.msrc.sunysb.edu/1984/messages/339.html real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/341.html sagem ringtones] [http://climate.msrc.sunysb.edu/1984/messages/351.html tracfone ringtones] [http://climate.msrc.sunysb.edu/1984/messages/328.html free nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=284 free punk ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226172687200.html mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=295 sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,12 ativan online] [http://climate.msrc.sunysb.edu/1984/messages/309.html but hgh] [http://climate.msrc.sunysb.edu/1984/messages/320.html free midi ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=7 alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=23 cheap flexeril] [http://climate.msrc.sunysb.edu/1984/messages/346.html sony ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=39 motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/359.html vicodin online] [http://www.bc.edu/apps/bookstore/cards/jun7-226062830562.html free tracfone ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=42 buy soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=260 levitra online] [http://climate.msrc.sunysb.edu/1984/messages/322.html free motorola ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=19 cheap didrex] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=84 cheap sildenafil] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=48 pharmacy online online] [http://climate.msrc.sunysb.edu/1984/messages/366.html zoloft online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=257 hydrocodone online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=63 free sony ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=82 cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=306 viagra] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=47 buy paxil] [http://climate.msrc.sunysb.edu/1984/messages/292.html ambien online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=264 buy lortab] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=28 order hydrocodone] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=85 vigrx online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=10 cheap ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=26 hgh online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=63 sildenafil online] [http://climate.msrc.sunysb.edu/1984/messages/358.html buy viagra] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=71 ortho online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=44 nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/316.html lisinopril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,24 free funny ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,46 free sony ericsson ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=307 buy vicodin] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,25 hydrocodone] [http://climate.msrc.sunysb.edu/1984/messages/293.html order ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=38 mono ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,18 clonazepam] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=31 levitra] [http://climate.msrc.sunysb.edu/1984/messages/349.html free sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=49 cialis online] [http://climate.msrc.sunysb.edu/1984/messages/347.html sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,26 cheap levitra] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=313 zanaflex online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=44 phentermine] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=12 celexa online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=69 ultracet online] [http://climate.msrc.sunysb.edu/1984/messages/362.html wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/343.html free sharp ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,36 buy norco] [http://climate.msrc.sunysb.edu/1984/messages/345.html soma online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=61 cheap ultracet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=242 free cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=232 cheap adipex] [http://climate.msrc.sunysb.edu/1984/messages/364.html cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=6 cheap albuterol] [http://climate.msrc.sunysb.edu/1984/messages/350.html cheap tenuate] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=83 cheap ortho] [http://climate.msrc.sunysb.edu/1984/messages/325.html free music ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=288 sagem ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=262 cheap lisinopril] [http://climate.msrc.sunysb.edu/1984/messages/319.html meridia online] [http://climate.msrc.sunysb.edu/1984/messages/335.html cheap propecia] [http://climate.msrc.sunysb.edu/1984/messages/360.html cheap vigrx] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=20 cheap diethylpropion] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=233 cheap albuterol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=40 mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=265 meridia online] [http://climate.msrc.sunysb.edu/1984/messages/307.html free ringtones] [http://climate.msrc.sunysb.edu/1984/messages/354.html cheap ultram] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=61 soma online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=35 cheap lortab] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=292 cheap sildenafil] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,34 free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/317.html cheap lorazepam] [http://climate.msrc.sunysb.edu/1984/messages/308.html free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/368.html diethylpropion online] [http://www.bc.edu/apps/bookstore/cards/jun7-226002359520.html free ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=76 funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/297.html cingular ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-224302380012.html cheap soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=274 nokia ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=55 clonazepam online] [http://climate.msrc.sunysb.edu/1984/messages/367.html zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=64 clomid online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=283 buy prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,53 online valium] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=33 order lisinopril] [http://www.bc.edu/apps/bookstore/cards/jun7-225692379850.html meridia online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=41 buy tramadol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=60 sharp ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=266 free midi ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=252 flexeril online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=55 real ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=240 celexa online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=314 zoloft online] [http://climate.msrc.sunysb.edu/1984/messages/327.html free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/304.html ericsson ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,32 free music ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=41 mtv ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,52 order ultram] [http://climate.msrc.sunysb.edu/1984/messages/356.html buy valium] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,55 viagra online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=58 lorazepam online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=13 cheap cialis] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,38 cheap phentermine] [http://climate.msrc.sunysb.edu/1984/messages/326.html buy nexium] [http://www.bc.edu/apps/bookstore/cards/jun7-226732674842.html samsung ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225822801712.html cheap norco] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=52 meridia online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,48 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=74 buy rivotril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,15 order carisoprodol] [http://climate.msrc.sunysb.edu/1984/messages/294.html carisoprodol online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=246 cyclobenzaprine online] [http://climate.msrc.sunysb.edu/1984/messages/369.html free qwest ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226472592872.html free qwest ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=47 cheap fioricet] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=72 verizon ringtones] [http://climate.msrc.sunysb.edu/1984/messages/337.html punk ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=256 cheap hoodia] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=279 pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=300 tracfone ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=301 tramadol] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=287 cheap rivotril] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=68 tramadol online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,21 didrex online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,22 cheap fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=271 music ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=65 cheap albuterol] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,35 free nokia ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225582064618.html buy viagra] [http://climate.msrc.sunysb.edu/1984/messages/291.html buy alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,59 buy xenical] [http://climate.msrc.sunysb.edu/1984/messages/332.html pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=254 free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/365.html order zanaflex] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=250 free ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=17 cyclobenzaprine online] [http://www.bc.edu/apps/bookstore/cards/jun7-225772801698.html adipex online] [http://www.bc.edu/apps/bookstore/cards/jun7-224662404428.html cheap xanax] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,9 free alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=54 free qwest ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=303 ultram online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=296 sonyericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/342.html free samsung ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=73 cheap lortab] [http://climate.msrc.sunysb.edu/1984/messages/321.html free mono ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=59 free samsung ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=315 zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=69 cheap celexa] [http://www.bc.edu/apps/bookstore/cards/jun7-226122830578.html free funny ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=310 wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/340.html cheap rivotril] [http://climate.msrc.sunysb.edu/1984/messages/298.html but clomid] [http://climate.msrc.sunysb.edu/1984/messages/305.html buy fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=255 buy hgh] [http://climate.msrc.sunysb.edu/1984/messages/315.html cheap lipitor] [http://climate.msrc.sunysb.edu/1984/messages/310.html cheap hoodia] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=15 clonazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=245 cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=66 tenuate online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=53 cheap vicodin] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=77 real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/348.html free sonyericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=27 buy hoodia] [http://climate.msrc.sunysb.edu/1984/messages/352.html buy tramadol] [http://www.bc.edu/apps/bookstore/cards/jun7-226422592864.html nextel ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=54 cheap alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,11 ambien online] #REDIRECT [[Global System for Mobile Communications]]
+
File Format Identification is the process of figuring out the format of a sequence of bytes. Operating systems typically do this by file extension or by embedded MIME information. Forensic applications need to identify file types by content.
 +
 
 +
=Tools=
 +
==libmagic==
 +
* Written in C.
 +
* Rules in /usr/share/file/magic and compiled at runtime.
 +
* Powers the Unix “file” command, but you can also call the library directly from a C program.
 +
* http://sourceforge.net/projects/libmagic
 +
 
 +
==DROID==
 +
* Writen in Java
 +
* Developed by National Archives of the United Kingdom.
 +
* http://droid.sourceforge.net
 +
 
 +
==TrID==
 +
* XML config file
 +
* Closed source; free for non-commercial use
 +
* http://mark0.net/soft-trid-e.html
 +
 
 +
==Forensic Innovations File Investigator TOOLS==
 +
* Proprietary, but free trial available.
 +
* Available as consumer applications and OEM API.
 +
* Identifies 3,000+ file types, using multiple methods to maintain high accuracy.
 +
* Extracts metadata for many of the supported file types.
 +
* http://www.forensicinnovations.com/fitools.html
 +
 
 +
==Stellent/Oracle Outside-In==
 +
* Proprietary but free demo.
 +
* http://www.oracle.com/technology/products/content-management/oit/oit_all.html
 +
 
 +
==[[Forensic Assistant]]==
 +
* Proprietary.
 +
* Provides detection of password protected archives, some files of cryptographic programs, Pinch/Zeus binary reports, etc.
 +
 
 +
[[Category:Tools]]
 +
 
 +
=Bibliography=
 +
Current research papers on the file format identification problem. Most of these papers concern themselves with identifying file format of a few file sectors, rather than an entire file.  '''Please note that this bibliography is in chronological order!'''
 +
 
 +
 
 +
;2001
 +
 
 +
* Mason McDaniel, [[Media:Mcdaniel01.pdf|Automatic File Type Detection Algorithm]], Masters Thesis, James Madison University,2001
 +
 
 +
; 2003
 +
 
 +
* [http://www2.computer.org/portal/web/csdl/abs/proceedings/hicss/2003/1874/09/187490332a.pdf Content Based File Type Detection Algorithms], Mason McDaniel and M. Hossain Heydari, 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9, 2003.
 +
 
 +
; 2005
 +
 
 +
* Fileprints: identifying file types by n-gram analysis, LiWei-Jen, Wang Ke, Stolfo SJ, Herzog B..,  IProceeding of the 2005 IEEE workshop on information assurance, 2005. ([http://www.itoc.usma.edu/workshop/2005/Papers/Follow%20ups/FilePrintPresentation-final.pdf Presentation Slides])  ([http://www1.cs.columbia.edu/ids/publications/FilePrintPaper-revised.pdf PDF])
 +
 
 +
* Douglas J. Hickok, Daine Richard Lesniak, Michael C. Rowe, File Type Detection Technology,  2005 Midwest Instruction and Computing Symposium.([http://www.micsymposium.org/mics_2005/papers/paper7.pdf PDF])
 +
 
 +
; 2006
 +
 
 +
* Karresand Martin, Shahmehri Nahid [http://ieeexplore.ieee.org/iel5/10992/34632/01652088.pdf  File type identification of data fragments by their binary structure. ], Proceedings of the IEEE workshop on information assurance, pp.140–147, 2006.([http://www.itoc.usma.edu/workshop/2006/Program/Presentations/IAW2006-07-3.pdf Presentation Slides])
 +
 
 +
* Gregory A. Hall, Sliding Window Measurement for File Type Identification, Computer Forensics and Intrusion Analysis Group, ManTech Security and Mission Assurance, 2006. ([http://www.mantechcfia.com/SlidingWindowMeasurementforFileTypeIdentification.pdf PDF])
 +
 
 +
* FORSIGS; Forensic Signature Analysis of the Hard Drive for Multimedia File Fingerprints, John Haggerty and Mark Taylor, IFIP TC11 International Information Security Conference, 2006, Sandton, South Africa.
 +
 
 +
* Martin Karresand , Nahid Shahmehri, "Oscar -- Using Byte Pairs to Find File Type and Camera Make of Data Fragments," Annual Workshop on Digital Forensics and Incident Analysis, Pontypridd, Wales, UK, pp.85-94, Springer-Verlag, 2006.
 +
 
 +
; 2007
 +
 
 +
* Karresand M., Shahmehri N., [http://dx.doi.org/10.1007/0-387-33406-8_35 Oscar: File Type Identification of Binary Data in Disk Clusters and RAM Pages], Proceedings of IFIP International Information Security Conference: Security and Privacy in Dynamic Environments (SEC2006), Springer, ISBN 0-387-33405-x, pp.413-424, Karlstad, Sweden, May 2006.
 +
 
 +
* Robert F. Erbacher and John Mulholland, "Identification and Localization of Data Types within Large-Scale File Systems," Proceedings of the 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, WA, April 2007.
 +
 
 +
* Ryan M. Harris, "Using Artificial Neural Networks for Forensic File Type Identification," Master's Thesis, Purdue University, May 2007. ([https://www.cerias.purdue.edu/tools_and_resources/bibtex_archive/archive/2007-19.pdf PDF])
 +
 
 +
* Predicting the Types of File Fragments, William Calhoun, Drue Coles, DFRWS 2008. ([http://www.dfrws.org/2008/proceedings/p14-calhoun_pres.pdf Presentation Slides])  ([http://www.dfrws.org/2008/proceedings/p14-calhoun.pdf PDF])
 +
 
 +
* Sarah J. Moody and Robert F. Erbacher, [http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=04545366 SÁDI – Statistical Analysis for Data type Identification], 3rd International Workshop on Systematic Approaches to Digital Forensic Engineering, 2008.
 +
 
 +
; 2008
 +
 
 +
* Mehdi Chehel Amirani, Mohsen Toorani, and Ali Asghar Beheshti Shirazi, [http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4625611 A New Approach to Content-based File Type Detection], Proceedings of the 13th IEEE Symposium on Computers and Communications (ISCC'08), pp.1103-1108, IEEE ComSoc, Marrakech, Morocco, July 2008.([http://webpages.iust.ac.ir/mtoorani/FTD.pdf Presentation Slides])  ([http://webpages.iust.ac.ir/mtoorani/C2.pdf PDF])
 +
 
 +
; 2009
 +
* Roussev, Vassil, and Garfinkel, Simson, "File Classification Fragment-The Case for Specialized Approaches," Systematic Approaches to Digital Forensics Engineering (IEEE/SADFE 2009), Oakland, California. ([http://simson.net/clips/academic/2009.SADFE.Fragments.pdf PDF])
 +
 
 +
* Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, [http://www.springerlink.com/content/g2655k2044615q75/ On Improving the Accuracy and Performance of Content-based File Type Identification], Proceedings of the 14th Australasian Conference on Information Security and Privacy (ACISP 2009), pp.44-59, LNCS (Springer), Brisbane, Australia, July 2009.
 +
 
 +
; 2010
 +
*Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, [http://www.alphaminers.net/sub05/sub05_03.php?swf_pn=5&swf_sn=3&swf_pn2=3 Fast File-type Identification], Proceedings of the 25th ACM Symposium on Applied Computing (ACM SAC 2010), ACM, Sierre, Switzerland, March 2010.
 +
[[Category:Bibliographies]]

Revision as of 07:02, 19 December 2009

File Format Identification is the process of figuring out the format of a sequence of bytes. Operating systems typically do this by file extension or by embedded MIME information. Forensic applications need to identify file types by content.

Tools

libmagic

  • Written in C.
  • Rules in /usr/share/file/magic and compiled at runtime.
  • Powers the Unix “file” command, but you can also call the library directly from a C program.
  • http://sourceforge.net/projects/libmagic

DROID

TrID

Forensic Innovations File Investigator TOOLS

  • Proprietary, but free trial available.
  • Available as consumer applications and OEM API.
  • Identifies 3,000+ file types, using multiple methods to maintain high accuracy.
  • Extracts metadata for many of the supported file types.
  • http://www.forensicinnovations.com/fitools.html

Stellent/Oracle Outside-In

Forensic Assistant

  • Proprietary.
  • Provides detection of password protected archives, some files of cryptographic programs, Pinch/Zeus binary reports, etc.

Bibliography

Current research papers on the file format identification problem. Most of these papers concern themselves with identifying file format of a few file sectors, rather than an entire file. Please note that this bibliography is in chronological order!


2001
2003
2005
  • Fileprints: identifying file types by n-gram analysis, LiWei-Jen, Wang Ke, Stolfo SJ, Herzog B.., IProceeding of the 2005 IEEE workshop on information assurance, 2005. (Presentation Slides) (PDF)
  • Douglas J. Hickok, Daine Richard Lesniak, Michael C. Rowe, File Type Detection Technology, 2005 Midwest Instruction and Computing Symposium.(PDF)
2006
  • Gregory A. Hall, Sliding Window Measurement for File Type Identification, Computer Forensics and Intrusion Analysis Group, ManTech Security and Mission Assurance, 2006. (PDF)
  • FORSIGS; Forensic Signature Analysis of the Hard Drive for Multimedia File Fingerprints, John Haggerty and Mark Taylor, IFIP TC11 International Information Security Conference, 2006, Sandton, South Africa.
  • Martin Karresand , Nahid Shahmehri, "Oscar -- Using Byte Pairs to Find File Type and Camera Make of Data Fragments," Annual Workshop on Digital Forensics and Incident Analysis, Pontypridd, Wales, UK, pp.85-94, Springer-Verlag, 2006.
2007
  • Robert F. Erbacher and John Mulholland, "Identification and Localization of Data Types within Large-Scale File Systems," Proceedings of the 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, WA, April 2007.
  • Ryan M. Harris, "Using Artificial Neural Networks for Forensic File Type Identification," Master's Thesis, Purdue University, May 2007. (PDF)
2008
2009
  • Roussev, Vassil, and Garfinkel, Simson, "File Classification Fragment-The Case for Specialized Approaches," Systematic Approaches to Digital Forensics Engineering (IEEE/SADFE 2009), Oakland, California. (PDF)
2010
  • Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, Fast File-type Identification, Proceedings of the 25th ACM Symposium on Applied Computing (ACM SAC 2010), ACM, Sierre, Switzerland, March 2010.