Difference between pages "Research Topics" and "Excel Spreadsheet (XLSB)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (=fiwalk Enhancements)
 
(MIME types)
 
Line 1: Line 1:
Interested in doing research in computer forensics? Looking for a master's topic, or just some ideas for a research paper? Here is my list. Please feel free to add your own ideas.
+
The '''Excel Spreadsheet (XLSB) file format''' has the '''.xlsb''' extension. This file type originates from [[Microsoft Excel]]. However, other spreadsheet software can be used to display these files as well. These include:
 +
* [[OpenOffice]] (probably as of version 3)
  
==Disk Forensics==
+
== MIME types ==
===SleuthKit Enhancements===
+
* Write a FUSE-based mounter for SleuthKit, so that disk images can be forensically mounted using TSK. (I've already started on this if you want the code.)
+
* Make SleuthKit handle Encrypted Files.
+
* Modify SleuthKit to report the physical location on disk of compressed files.
+
  
===fiwalk Enhancements===
+
== File signature ==
* Automatically
+
===Stream Forensics===
+
* Process the entire disk with one pass, or at most two, to minimize seek time. 
+
  
===Evidence Falsification===
+
[[Microsoft Excel]] spreadsheets of version 2007 are stored in a [[ZIP archive]] file. These files therefore have the ZIP file signature
* Automatically detect falsified digital evidence.
+
  
===Sanitization===
+
== See Also==
* Detect and diagnose sanitization attempts.
+
  
 +
[[Excel Spreadsheet (XLS)]]
  
===[[AFF]] Enhancement===
+
[[Excel Spreadsheet (XLSX)]]
* Replace the AFF "BADFLAG" approach for indicating bad data with a bad sector bitmap.
+
  
* Modify aimage so that it can take a partial disk image and a disk and just image what's missing.
+
[http://download.microsoft.com/download/0/B/E/0BE8BDD7-E5E8-422A-ABFD-4342ED7AD886/Excel2007BinaryFileFormat(xlsb)Specification.pdf Excel 2007 Binary File format by Microsoft]
  
* Improve the data recovery features of aimage.
+
[[Category:File Formats]]
 
+
* Replace AFF's current table-of-contents system with one based on B+ Trees.
+
 
+
==Timeline Analysis==
+
Write a new timeline viewer that supports:
+
* Logfile fusion (with offsets)
+
* Logfile correlation
+
* View logfiles in the frequency domain.
+
 
+
==Carving==
+
===JPEG Validator===
+
Create a JPEG decompresser that supports restarts and checkpointing for use in high-speed carving.
+
 
+
 
+
==Cell Phone Exploitation==
+
===Imaging===
+
Develop a tool for imaging the contents of a cell phone memory
+
===Interpretation===
+
* Develop a tool for reassembling information in a cell phone memory
+
 
+
 
+
==Corpora Development==
+
===Realistic Disk Corpora===
+
There is need for realistic corpora that can be freely redistributed but do not contain any confidential personally identifiable information (PII).
+
 
+
These disk images may be either of an external drive or of a system boot drive. The drive images should have signs of ''wear'' --- that is, they should have resident files, deleted files, partially overwritten files, contiguous files, and fragmented files.
+
 
+
From DFRWS 2005
+
Frank Adelstein (ATC-NY), Yun Gao and Golden G. Richard III (University of New Orleans): Automatically Creating Realistic Targets for Digital Forensics Investigation http://www.dfrws.org/2005/program.shtml
+
 
+
===Realistic Network Traffic===
+
Generating realistic network traffic requires constructing a test network and either recording interactions within the network or with an external network.
+

Latest revision as of 04:53, 31 January 2009

The Excel Spreadsheet (XLSB) file format has the .xlsb extension. This file type originates from Microsoft Excel. However, other spreadsheet software can be used to display these files as well. These include:

MIME types

File signature

Microsoft Excel spreadsheets of version 2007 are stored in a ZIP archive file. These files therefore have the ZIP file signature

See Also

Excel Spreadsheet (XLS)

Excel Spreadsheet (XLSX)

Excel 2007 Binary File format by Microsoft