Difference between pages "GSM" and "File Format Identification"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
m (formatting Bibliographies)
 
Line 1: Line 1:
[http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=18 cheap diazepam] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=312 cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=45 nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=285 qwest ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=79 zanaflex online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=247 diazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=305 verizon ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226682379944.html free motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/318.html order lortab] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=62 prozac online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=21 ericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/330.html but ortho] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,19 cheap cyclobenzaprine] [http://climate.msrc.sunysb.edu/1984/messages/295.html cheap celexa] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=253 free ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=49 phentermine] [http://climate.msrc.sunysb.edu/1984/messages/300.html free cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=52 cheap prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,44 free qwest ringtones] [http://climate.msrc.sunysb.edu/1984/messages/296.html cialis online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=297 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=60 nexium online] [http://climate.msrc.sunysb.edu/1984/messages/339.html real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/341.html sagem ringtones] [http://climate.msrc.sunysb.edu/1984/messages/351.html tracfone ringtones] [http://climate.msrc.sunysb.edu/1984/messages/328.html free nokia ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=284 free punk ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226172687200.html mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=295 sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,12 ativan online] [http://climate.msrc.sunysb.edu/1984/messages/309.html but hgh] [http://climate.msrc.sunysb.edu/1984/messages/320.html free midi ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=7 alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=23 cheap flexeril] [http://climate.msrc.sunysb.edu/1984/messages/346.html sony ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=39 motorola ringtones] [http://climate.msrc.sunysb.edu/1984/messages/359.html vicodin online] [http://www.bc.edu/apps/bookstore/cards/jun7-226062830562.html free tracfone ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=42 buy soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=260 levitra online] [http://climate.msrc.sunysb.edu/1984/messages/322.html free motorola ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=19 cheap didrex] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=84 cheap sildenafil] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=48 pharmacy online online] [http://climate.msrc.sunysb.edu/1984/messages/366.html zoloft online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=257 hydrocodone online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=63 free sony ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=82 cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=306 viagra] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=47 buy paxil] [http://climate.msrc.sunysb.edu/1984/messages/292.html ambien online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=264 buy lortab] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=28 order hydrocodone] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=85 vigrx online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=10 cheap ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=26 hgh online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=63 sildenafil online] [http://climate.msrc.sunysb.edu/1984/messages/358.html buy viagra] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=71 ortho online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=44 nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/316.html lisinopril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,24 free funny ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,46 free sony ericsson ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=307 buy vicodin] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,25 hydrocodone] [http://climate.msrc.sunysb.edu/1984/messages/293.html order ativan] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=38 mono ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,18 clonazepam] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=31 levitra] [http://climate.msrc.sunysb.edu/1984/messages/349.html free sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=49 cialis online] [http://climate.msrc.sunysb.edu/1984/messages/347.html sony ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,26 cheap levitra] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=313 zanaflex online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=44 phentermine] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=12 celexa online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=69 ultracet online] [http://climate.msrc.sunysb.edu/1984/messages/362.html wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/343.html free sharp ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,36 buy norco] [http://climate.msrc.sunysb.edu/1984/messages/345.html soma online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=61 cheap ultracet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=242 free cingular ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=232 cheap adipex] [http://climate.msrc.sunysb.edu/1984/messages/364.html cheap xenical] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=6 cheap albuterol] [http://climate.msrc.sunysb.edu/1984/messages/350.html cheap tenuate] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=83 cheap ortho] [http://climate.msrc.sunysb.edu/1984/messages/325.html free music ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=288 sagem ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=262 cheap lisinopril] [http://climate.msrc.sunysb.edu/1984/messages/319.html meridia online] [http://climate.msrc.sunysb.edu/1984/messages/335.html cheap propecia] [http://climate.msrc.sunysb.edu/1984/messages/360.html cheap vigrx] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=20 cheap diethylpropion] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=233 cheap albuterol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=40 mp3 ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=265 meridia online] [http://climate.msrc.sunysb.edu/1984/messages/307.html free ringtones] [http://climate.msrc.sunysb.edu/1984/messages/354.html cheap ultram] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=61 soma online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=35 cheap lortab] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=292 cheap sildenafil] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,34 free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/317.html cheap lorazepam] [http://climate.msrc.sunysb.edu/1984/messages/308.html free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/368.html diethylpropion online] [http://www.bc.edu/apps/bookstore/cards/jun7-226002359520.html free ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=76 funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/297.html cingular ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-224302380012.html cheap soma] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=274 nokia ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=55 clonazepam online] [http://climate.msrc.sunysb.edu/1984/messages/367.html zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=64 clomid online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=283 buy prozac] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,53 online valium] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=33 order lisinopril] [http://www.bc.edu/apps/bookstore/cards/jun7-225692379850.html meridia online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=41 buy tramadol] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=60 sharp ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=266 free midi ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=252 flexeril online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=55 real ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=240 celexa online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=314 zoloft online] [http://climate.msrc.sunysb.edu/1984/messages/327.html free nextel ringtones] [http://climate.msrc.sunysb.edu/1984/messages/304.html ericsson ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,32 free music ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=41 mtv ringtones] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,52 order ultram] [http://climate.msrc.sunysb.edu/1984/messages/356.html buy valium] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,55 viagra online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=58 lorazepam online] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=13 cheap cialis] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,38 cheap phentermine] [http://climate.msrc.sunysb.edu/1984/messages/326.html buy nexium] [http://www.bc.edu/apps/bookstore/cards/jun7-226732674842.html samsung ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225822801712.html cheap norco] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=52 meridia online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,48 sprint ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=74 buy rivotril] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,15 order carisoprodol] [http://climate.msrc.sunysb.edu/1984/messages/294.html carisoprodol online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=246 cyclobenzaprine online] [http://climate.msrc.sunysb.edu/1984/messages/369.html free qwest ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-226472592872.html free qwest ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=47 cheap fioricet] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=72 verizon ringtones] [http://climate.msrc.sunysb.edu/1984/messages/337.html punk ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=256 cheap hoodia] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=279 pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=300 tracfone ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=301 tramadol] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=287 cheap rivotril] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=68 tramadol online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,21 didrex online] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,22 cheap fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=271 music ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=65 cheap albuterol] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,35 free nokia ringtones] [http://www.bc.edu/apps/bookstore/cards/jun7-225582064618.html buy viagra] [http://climate.msrc.sunysb.edu/1984/messages/291.html buy alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,59 buy xenical] [http://climate.msrc.sunysb.edu/1984/messages/332.html pharmacy online online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=254 free funny ringtones] [http://climate.msrc.sunysb.edu/1984/messages/365.html order zanaflex] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=250 free ericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=17 cyclobenzaprine online] [http://www.bc.edu/apps/bookstore/cards/jun7-225772801698.html adipex online] [http://www.bc.edu/apps/bookstore/cards/jun7-224662404428.html cheap xanax] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,9 free alltel ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=54 free qwest ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=303 ultram online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=296 sonyericsson ringtones] [http://climate.msrc.sunysb.edu/1984/messages/342.html free samsung ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=73 cheap lortab] [http://climate.msrc.sunysb.edu/1984/messages/321.html free mono ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=59 free samsung ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=315 zyban online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=69 cheap celexa] [http://www.bc.edu/apps/bookstore/cards/jun7-226122830578.html free funny ringtones] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=310 wwe ringtones] [http://climate.msrc.sunysb.edu/1984/messages/340.html cheap rivotril] [http://climate.msrc.sunysb.edu/1984/messages/298.html but clomid] [http://climate.msrc.sunysb.edu/1984/messages/305.html buy fioricet] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=255 buy hgh] [http://climate.msrc.sunysb.edu/1984/messages/315.html cheap lipitor] [http://climate.msrc.sunysb.edu/1984/messages/310.html cheap hoodia] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=15 clonazepam online] [http://mrsrl.stanford.edu/seminar/detailview.php?event_id=245 cool ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=66 tenuate online] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=53 cheap vicodin] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=77 real ringtones] [http://climate.msrc.sunysb.edu/1984/messages/348.html free sonyericsson ringtones] [http://ocw201-1.usc.edu/iPIDD/ju_board/view.php?message_ID=27 buy hoodia] [http://climate.msrc.sunysb.edu/1984/messages/352.html buy tramadol] [http://www.bc.edu/apps/bookstore/cards/jun7-226422592864.html nextel ringtones] [http://groups.ku.edu/cgi-bin/cgiwrap/kuksa/forum/ezboard.cgi?db=general&action=read&dbf=54 cheap alprazolam] [http://brown.cla.sc.edu/projects/pas/bforum/index.php?method=showhtmllist&list=message&rollid=2,11 ambien online] #REDIRECT [[Global System for Mobile Communications]]
+
File Format Identification is the process of figuring out the format of a sequence of bytes. Operating systems typically do this by file extension or by embedded MIME information. Forensic applications need to identify file types by content.
 +
 
 +
=Tools=
 +
==libmagic==
 +
* Written in C.
 +
* Rules in /usr/share/file/magic and compiled at runtime.
 +
* Powers the Unix “file” command, but you can also call the library directly from a C program.
 +
* http://sourceforge.net/projects/libmagic
 +
 
 +
==DROID==
 +
* Writen in Java
 +
* Developed by National Archives of the United Kingdom.
 +
* http://droid.sourceforge.net
 +
 
 +
==TrID==
 +
* XML config file
 +
* Closed source; free for non-commercial use
 +
* http://mark0.net/soft-trid-e.html
 +
 
 +
==Forensic Innovations File Investigator TOOLS==
 +
* Proprietary, but free trial available.
 +
* Available as consumer applications and OEM API.
 +
* Identifies 3,000+ file types, using multiple methods to maintain high accuracy.
 +
* Extracts metadata for many of the supported file types.
 +
* http://www.forensicinnovations.com/fitools.html
 +
 
 +
==Stellent/Oracle Outside-In==
 +
* Proprietary but free demo.
 +
* http://www.oracle.com/technology/products/content-management/oit/oit_all.html
 +
 
 +
==[[Forensic Assistant]]==
 +
* Proprietary.
 +
* Provides detection of password protected archives, some files of cryptographic programs, Pinch/Zeus binary reports, etc.
 +
 
 +
[[Category:Tools]]
 +
 
 +
=Bibliography=
 +
Current research papers on the file format identification problem. Most of these papers concern themselves with identifying file format of a few file sectors, rather than an entire file.  '''Please note that this bibliography is in chronological order!'''
 +
 
 +
 
 +
;2001
 +
 
 +
* Mason McDaniel, [[Media:Mcdaniel01.pdf|Automatic File Type Detection Algorithm]], Masters Thesis, James Madison University,2001
 +
 
 +
; 2003
 +
 
 +
* [http://www2.computer.org/portal/web/csdl/abs/proceedings/hicss/2003/1874/09/187490332a.pdf Content Based File Type Detection Algorithms], Mason McDaniel and M. Hossain Heydari, 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9, 2003.
 +
 
 +
; 2005
 +
 
 +
* Fileprints: identifying file types by n-gram analysis, LiWei-Jen, Wang Ke, Stolfo SJ, Herzog B..,  IProceeding of the 2005 IEEE workshop on information assurance, 2005. ([http://www.itoc.usma.edu/workshop/2005/Papers/Follow%20ups/FilePrintPresentation-final.pdf Presentation Slides])  ([http://www1.cs.columbia.edu/ids/publications/FilePrintPaper-revised.pdf PDF])
 +
 
 +
* Douglas J. Hickok, Daine Richard Lesniak, Michael C. Rowe, File Type Detection Technology,  2005 Midwest Instruction and Computing Symposium.([http://www.micsymposium.org/mics_2005/papers/paper7.pdf PDF])
 +
 
 +
; 2006
 +
 
 +
* Karresand Martin, Shahmehri Nahid [http://ieeexplore.ieee.org/iel5/10992/34632/01652088.pdf  File type identification of data fragments by their binary structure. ], Proceedings of the IEEE workshop on information assurance, pp.140–147, 2006.([http://www.itoc.usma.edu/workshop/2006/Program/Presentations/IAW2006-07-3.pdf Presentation Slides])
 +
 
 +
* Gregory A. Hall, Sliding Window Measurement for File Type Identification, Computer Forensics and Intrusion Analysis Group, ManTech Security and Mission Assurance, 2006. ([http://www.mantechcfia.com/SlidingWindowMeasurementforFileTypeIdentification.pdf PDF])
 +
 
 +
* FORSIGS; Forensic Signature Analysis of the Hard Drive for Multimedia File Fingerprints, John Haggerty and Mark Taylor, IFIP TC11 International Information Security Conference, 2006, Sandton, South Africa.
 +
 
 +
* Martin Karresand , Nahid Shahmehri, "Oscar -- Using Byte Pairs to Find File Type and Camera Make of Data Fragments," Annual Workshop on Digital Forensics and Incident Analysis, Pontypridd, Wales, UK, pp.85-94, Springer-Verlag, 2006.
 +
 
 +
; 2007
 +
 
 +
* Karresand M., Shahmehri N., [http://dx.doi.org/10.1007/0-387-33406-8_35 Oscar: File Type Identification of Binary Data in Disk Clusters and RAM Pages], Proceedings of IFIP International Information Security Conference: Security and Privacy in Dynamic Environments (SEC2006), Springer, ISBN 0-387-33405-x, pp.413-424, Karlstad, Sweden, May 2006.
 +
 
 +
* Robert F. Erbacher and John Mulholland, "Identification and Localization of Data Types within Large-Scale File Systems," Proceedings of the 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, WA, April 2007.
 +
 
 +
* Ryan M. Harris, "Using Artificial Neural Networks for Forensic File Type Identification," Master's Thesis, Purdue University, May 2007. ([https://www.cerias.purdue.edu/tools_and_resources/bibtex_archive/archive/2007-19.pdf PDF])
 +
 
 +
* Predicting the Types of File Fragments, William Calhoun, Drue Coles, DFRWS 2008. ([http://www.dfrws.org/2008/proceedings/p14-calhoun_pres.pdf Presentation Slides])  ([http://www.dfrws.org/2008/proceedings/p14-calhoun.pdf PDF])
 +
 
 +
* Sarah J. Moody and Robert F. Erbacher, [http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=04545366 SÁDI – Statistical Analysis for Data type Identification], 3rd International Workshop on Systematic Approaches to Digital Forensic Engineering, 2008.
 +
 
 +
; 2008
 +
 
 +
* Mehdi Chehel Amirani, Mohsen Toorani, and Ali Asghar Beheshti Shirazi, [http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4625611 A New Approach to Content-based File Type Detection], Proceedings of the 13th IEEE Symposium on Computers and Communications (ISCC'08), pp.1103-1108, IEEE ComSoc, Marrakech, Morocco, July 2008.([http://webpages.iust.ac.ir/mtoorani/FTD.pdf Presentation Slides])  ([http://webpages.iust.ac.ir/mtoorani/C2.pdf PDF])
 +
 
 +
; 2009
 +
* Roussev, Vassil, and Garfinkel, Simson, "File Classification Fragment-The Case for Specialized Approaches," Systematic Approaches to Digital Forensics Engineering (IEEE/SADFE 2009), Oakland, California. ([http://simson.net/clips/academic/2009.SADFE.Fragments.pdf PDF])
 +
 
 +
* Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, [http://www.springerlink.com/content/g2655k2044615q75/ On Improving the Accuracy and Performance of Content-based File Type Identification], Proceedings of the 14th Australasian Conference on Information Security and Privacy (ACISP 2009), pp.44-59, LNCS (Springer), Brisbane, Australia, July 2009.
 +
 
 +
; 2010
 +
*Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, [http://www.alphaminers.net/sub05/sub05_03.php?swf_pn=5&swf_sn=3&swf_pn2=3 Fast File-type Identification], Proceedings of the 25th ACM Symposium on Applied Computing (ACM SAC 2010), ACM, Sierre, Switzerland, March 2010.
 +
[[Category:Bibliographies]]

Revision as of 02:02, 19 December 2009

File Format Identification is the process of figuring out the format of a sequence of bytes. Operating systems typically do this by file extension or by embedded MIME information. Forensic applications need to identify file types by content.

Tools

libmagic

  • Written in C.
  • Rules in /usr/share/file/magic and compiled at runtime.
  • Powers the Unix “file” command, but you can also call the library directly from a C program.
  • http://sourceforge.net/projects/libmagic

DROID

TrID

Forensic Innovations File Investigator TOOLS

  • Proprietary, but free trial available.
  • Available as consumer applications and OEM API.
  • Identifies 3,000+ file types, using multiple methods to maintain high accuracy.
  • Extracts metadata for many of the supported file types.
  • http://www.forensicinnovations.com/fitools.html

Stellent/Oracle Outside-In

Forensic Assistant

  • Proprietary.
  • Provides detection of password protected archives, some files of cryptographic programs, Pinch/Zeus binary reports, etc.

Bibliography

Current research papers on the file format identification problem. Most of these papers concern themselves with identifying file format of a few file sectors, rather than an entire file. Please note that this bibliography is in chronological order!


2001
2003
2005
  • Fileprints: identifying file types by n-gram analysis, LiWei-Jen, Wang Ke, Stolfo SJ, Herzog B.., IProceeding of the 2005 IEEE workshop on information assurance, 2005. (Presentation Slides) (PDF)
  • Douglas J. Hickok, Daine Richard Lesniak, Michael C. Rowe, File Type Detection Technology, 2005 Midwest Instruction and Computing Symposium.(PDF)
2006
  • Gregory A. Hall, Sliding Window Measurement for File Type Identification, Computer Forensics and Intrusion Analysis Group, ManTech Security and Mission Assurance, 2006. (PDF)
  • FORSIGS; Forensic Signature Analysis of the Hard Drive for Multimedia File Fingerprints, John Haggerty and Mark Taylor, IFIP TC11 International Information Security Conference, 2006, Sandton, South Africa.
  • Martin Karresand , Nahid Shahmehri, "Oscar -- Using Byte Pairs to Find File Type and Camera Make of Data Fragments," Annual Workshop on Digital Forensics and Incident Analysis, Pontypridd, Wales, UK, pp.85-94, Springer-Verlag, 2006.
2007
  • Robert F. Erbacher and John Mulholland, "Identification and Localization of Data Types within Large-Scale File Systems," Proceedings of the 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, WA, April 2007.
  • Ryan M. Harris, "Using Artificial Neural Networks for Forensic File Type Identification," Master's Thesis, Purdue University, May 2007. (PDF)
  • Predicting the Types of File Fragments, William Calhoun, Drue Coles, DFRWS 2008. (Presentation Slides) (PDF)
2008
2009
  • Roussev, Vassil, and Garfinkel, Simson, "File Classification Fragment-The Case for Specialized Approaches," Systematic Approaches to Digital Forensics Engineering (IEEE/SADFE 2009), Oakland, California. (PDF)
2010
  • Irfan Ahmed, Kyung-suk Lhee, Hyunjung Shin and ManPyo Hong, Fast File-type Identification, Proceedings of the 25th ACM Symposium on Applied Computing (ACM SAC 2010), ACM, Sierre, Switzerland, March 2010.