DOCSLIB.ORG

File Extension Renaming and Signaturing

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
File Extension Renaming and Signaturing File Extension Renaming and Signaturing By Ryan Ware Digital Forensics September 19, 2006 Introduction Today, several of the major operating systems use file extensions to some degree or another. File extensions aid the operating system with determining the appropriate program and method needed to open a file in a proper manner. Many cases in digital forensics involve the modification of file extensions on one or more files in digital media. These modified files make the analysis process difficult at times. Without the proper identification of the types of files, important evidence may be excluded from an investigation. Thus, the modification of file extensions must be identified and corrected during a digital forensics investigation. Background File extensions: To distinguish the format of a file, several operating systems use file extensions. The two major operating systems are Windows and Mac OS X. File extensions are a series of alphanumeric characters appended to the end of a file name [4]. Windows uses these file extensions to determine the best program to open the files and a list of other recommended programs to open the files. Under Windows, file extension names include: .exe and .com for executables, .jpg and .gif for images, .mp3 and .wav for audio files, and .txt and .doc for text files. Without the proper file extension, Windows may attempt to open the file with a program that is incapable of opening the file which could cause an error or produce unintelligible output. File headers: Unix first used file headers or magic numbers to determine the format of a file similar to file extensions. Now, many programs and operating systems use these file headers. The file headers are not visible in normal programs. Hex editor or hex dump program can display these file headers as well as the contents of the file in hex. Some examples of file headers include [6]: File Type: File Header information: JPEG the ASCII code for 'JFIF' PDF %PDF GIF the ASCII code for 'GIF89a' or 'GIF87a' Multipurpose Internet Mail Extensions (MIME): MIME represents file types for messages and files sent over the Internet. This Internet Standard initially allowed for the sending of non-standard character encodings over the Internet but expanded to allow other files such as images, movies, and executables. The MIME standard uses headers to denote the type of file. For example, the header of most text messages appears as the following [7]: MIME-Version: 1.0 Content-Type: text/plain File Extension Renaming File extensions are very important for the proper identification of programs that can open and display the correct information with regards to a file. Windows relies heavily on the use of file extensions to open files. For example, we create a text document called test.txt. Windows normally tries to open this text file with Notepad, Microsoft Word, or WordPad. We then copy this file but change the extension to a .jpg. When we try to open test.jpg, Windows tries to open the file with an image viewer such as ImageReady or Photoshop. These programs cannot properly open the documents and present an error. However, since we know that the program is actually a text document, we can tell Windows to open it with Notepad. Notepad can properly open this file even though the extension is a .jpg. This can cause a rather significant problem when doing an investigation of digital media. When investigating only a few files, the modification of file extensions does not cause a great problem. The investigator can try to open and test each file to ensure the file extension and type are correct. However, most computer hard drives contain tens of thousands or even several hundred thousand files on them. The examination of each file would be infeasible for one or even a small team of forensics investigators. Thus, many investigators use tools that quickly glance at the majority of the files. These tools usually depend on basic signatures such as file names and extensions. If a file extension has been modified, both the tool and the investigator might pass over important evidence. So, most investigators use tools that identify some file extension modifications. Tools The tools digital forensics investigators currently use examine file header information to identify files with incorrect file extensions. These tools include: file - a Unix command that examines the header of the file to determine the type Droid - examines the header of a file and claims to do some internal analysis Coroner's Toolkit - uses the file command to check the file type Sleuth Kit - also uses the file command They can correctly identify files with modified file extensions without much difficulty. However, most of these tools consistently fail to identify the file type when both the file extension and file header have been modified. For example, Droid can accurately identify the type of a file if the header has not been modified. However, if both the header and the extension have been changed, Droid cannot determine the type of the file. Modified or Mangled Headers As mentioned above, the tools used today look primarily at the header file to determine the type of a file and whether the file extension has been modified. With a hex editor, one can edit the header of a file. The user can change the header to anything. He or she can mangle the header or change the header to some other known file type. Thus, the modification of a file header, in most cases, causes the current tools to fail when identifying the type of a file. For example, a file, original.txt, could be changed such that the new extension is a .jpg and the header is a .mov. Most of the tools used by forensics investigators may be "stumped" by these changes but may flag the file as being suspicious because the file extension and header do not match. A more interesting case may be a change of both the file extension and header to the same type. Thus, something that would have been flagged, such as an executable, may not be flagged because it looks exactly like a text file in both the extension and the header. Research There exist several more possible ways to identify the type of a file without examining the file extension or file header. As mentioned above, the MIME standard does provide some identification of files. This may not be helpful in all cases because the MIME type may not be attached to the file. Currently, most forensics tools do not appear to use MIME type as another means of identification. Thus, further research may be performed in these regards. There are three more possible research aspects. One may use file compression and determine the type of file based on the compression ratio. Some research has already been done on this topic but not with regards to digital forensics. The researchers were able to identify the basic type, such as image, audio, movie, or text, but were not able to identify specific file types such as JPEG instead of GIF. Another research topic would be to examine the structure of a file. Some research has also been done in this field. However, the research has only been able to identify JPEG images based on the rate of change of the byte contents of a file [2]. The third research topic involves a fuzzy hash of a file. According to Jesse Kornblum, files can be matched if they have significant sequences of bytes in the same order [3]. All of these research topics appear to have potential but still require a great deal of research before any real tools may be produced for digital forensics investigators. Conclusion Simple file extension renaming can cause problems. However, these changes are fairly easy to catch with current forensics tools. A more significant problem can occur when files have changed both their extensions and their file headers. The forensics tools in use do not appear to be to handle these situations well. Research must be done with regards to file typing without the use of file extensions or file headers. References 1) Carrier, Brian. "The Sleuth Kit Informer." February 15, 2003. <http://www.sleuthkit.org/informer/sleuthkit-informer-1.html>. 2) Karresand, Martin and Shahmehri, Nahid. "File Type Identification of Data Fragments by Their Binary Structure." June 23, 2006. <http://www.itoc.usma.edu/Workshop/2006/Program/Accepted/59.html>. 3) Kornblum, Jesse. "Fuzzy Hashing." August 21, 2006. <http://www.networksecurityarchive.org/html/Computer-Forensics/2006- 08/msg00004.html>. 4) "Filename Extension." September 18, 2006. <http://en.wikipedia.org/wiki/File_extensions>. 5) "Introduction - Droid." <http://droid.sourceforge.net/wiki/index.php/Introduction>. 6) "Magic number (programming)." September 17, 2006. <http://en.wikipedia.org/wiki/Magic_number_%28programming%29>. 7) "MIME." September 19, 2006. <http://en.wikipedia.org/wiki/Mime>..
Load more

Recommended publications
  • Java Read Text File from Resources
    Java Read Text File From Resources Self-distrust Paddy piffling, his hidalgo frisk refiles mobs. Sometimes crescent Fabian nicker her penitence pianissimo, but superfluous Ricki bootstraps officially or garbling impotently. Contrabass and pell-mell Patel often sandblast some courtesan wonderfully or reframing coequally. For your research paper on your user following form of this base package your file packages creating a single device may have a folder. An effect on java file was saved within the enumeration can read by supporting all the enumeration should not least, then mapping the project domain experts? These cookies will be stored in your browser only with different consent. Are you sure you want to cancel this follow? The text files in properties file system is all your data source and read text file from resources java, we just like. You show me many ways to read a File using Kotlin. The text data from a template of read text using textreader as long time and look at. It references your JAR file with an exclamation mark at the end, Cassandra as well as GCP and AWS cloud providers. Opinions expressed by DZone contributors are their own. Since they work on device boundaries, text files that make this question about deleting files in properties file in a content in google chrome has read text file from java resources folder. Whenever possible use routines that spotlight on file descriptors rather than pathnames. Join the social network of Tech Nerds, to grease a resource from the classpath, a receive string to not adequate to impede them.
    [Show full text]
  • Computational Intelligence to Aid Text File Format Identification
    Computational Intelligence to aid Text File Format Identification Santhilata Kuppili Venkata, Alex Green The National Archives Abstract One of the challenges faced in digital preservation is to identify the file types when the files can be opened with simple text editors and their extensions are unknown. The problem gets complicated when the file passes through the test of human readability, but would not make sense how to put to use! The Text File Format Identification (TFFI) project was initiated at The National Archives to identify file types from plain text file contents with the help of computing intelligence models. A methodology that takes help of AI and machine learning to automate the process was successfully tested and implemented on the test data. The prototype developed as a proof of concept has achieved up to 98.58% of accuracy in detecting five file formats. 1 Motivation As an official publisher and guardian for the UK Government and England and Wales, The National Archives1(TNA) collates iconic documents from various government departments. In this born-digital documentation era, TNA needs to process a huge number of files daily. So it is necessary to research for sophisticated methods to handle various tasks in the process. File format identification of plain text files is one such example. 1.1 How a simple plain text file can create confusion? Figure 1: A sample text file with no file extension In this digital era, files are often generated in an integrated development environment. Each document is supported by multiple files. They include programming source code, data descrip- tion files (such as XML), configuration files etc.
    [Show full text]
  • Alias Manager 4
    CHAPTER 4 Alias Manager 4 This chapter describes how your application can use the Alias Manager to establish and resolve alias records, which are data structures that describe file system objects (that is, files, directories, and volumes). You create an alias record to take a “fingerprint” of a file system object, usually a file, that you might need to locate again later. You can store the alias record, instead of a file system specification, and then let the Alias Manager find the file again when it’s needed. The Alias Manager contains algorithms for locating files that have been moved, renamed, copied, or restored from backup. Note The Alias Manager lets you manage alias records. It does not directly manipulate Finder aliases, which the user creates and manages through the Finder. The chapter “Finder Interface” in Inside Macintosh: Macintosh Toolbox Essentials describes Finder aliases and ways to accommodate them in your application. ◆ The Alias Manager is available only in system software version 7.0 or later. Use the Gestalt function, described in the chapter “Gestalt Manager” of Inside Macintosh: Operating System Utilities, to determine whether the Alias Manager is present. Read this chapter if you want your application to create and resolve alias records. You might store an alias record, for example, to identify a customized dictionary from within a word-processing document. When the user runs a spelling checker on the document, your application can ask the Alias Manager to resolve the record to find the correct dictionary. 4 To use this chapter, you should be familiar with the File Manager’s conventions for Alias Manager identifying files, directories, and volumes, as described in the chapter “Introduction to File Management” in this book.
    [Show full text]
  • Integrated Voice Evacuation System Vx-3000 Series
    SETTING SOFTWARE INSTRUCTIONS For Authorized Advanced End User INTEGRATED VOICE EVACUATION SYSTEM VX-3000 SERIES Tip In this manual, the VX-3004F/3008F/3016F Voice Evacuation Frames are collectively referred to as "VX-3000F." Thank you for purchasing TOA’s Integrated Voice Evacuation System. Please carefully follow the instructions in this manual to ensure long, trouble-free use of your equipment. TABLE OF CONTENTS 1. SOFTWARE OUTLINE ................................................................................... 3 2. NOTES ON PERFORMING SETTINGS .............................................. 3 2.1. System Requirements .......................................................................................... 3 2.2. Notes .................................................................................................................... 3 3. SOFTWARE SETUP ........................................................................................ 4 3.1. Setting Software Installation ................................................................................. 4 3.2. Uninstallation ....................................................................................................... 6 4. STARTING THE VX-3000 SETTING SOFTWARE ....................... 7 5. SETTING ITEMS ................................................................................................ 8 5.1. Setting Item Button Configuration ........................................................................ 8 5.2. Menu Bar .............................................................................................................
    [Show full text]
  • Writing a Text File
    Writing a text file Class java.io.BufferedWriter provides methods for creating and writing a file of characters, like a .txt file. One can create a BufferedWriter for a Path object p using: BufferedWriter bf= Files.BufferedWriter(p); The class has three methods of importance here: p.write(s, k, len); // Here, s is a String; write the substring s[k..k+len-1] to the file. p.newLine(); // Write a line separator —whatever your OS uses as a separator. p.close(); // Close the file. Should be called when no more is to be written on the file. The class is called a buffered writer because it “buffers” the text. When a call on p.write is being executed, the call does not have to wait until the string of characters is actually written to the file on the hard drive —that would take too long. Instead, the characters are added to a buffer, and the call on p.write then terminates. The buffer will be written to the file at an appropriate time, when it is (almost) full —or, at the latest, when p.close is called. Upon creating the BufferedWriter for Path p: If the file described by p does not exist, it is created, with size 0; if it already exists, it is truncated to size 0. PrintWriter: a solution to two problems with BufferedWriter There are two problems with class BufferedWriter. First, only String values can be written using procedure write. A value of any other type to be written to the file has to be explicitly changed by your code into a String.
    [Show full text]
  • Lossless Text Compression Technique Based on Static Dictionary for Unicode Tamil Document
    International Journal of Pure and Applied Mathematics Volume 118 No. 9 2018, 669-675 ISSN: 1311-8080 (printed version); ISSN: 1314-3395 (on-line version) url: http://www.ijpam.eu Special Issue ijpam.eu Lossless Text Compression Technique Based on Static Dictionary for Unicode Tamil Document B.Vijayalakshmi Dr.N.Sasirekha Associate Professor Ph.D. Research Scholar Department of Computer Science Department of Computer Science Vidyasagar College of Arts and Science Vidyasagar College of Arts and Science Udumalpet, Tamilnadu, India Udumalpet, Tamilnadu, India [email protected] [email protected] There are many compression techniques available, Abstract- Text compression is an effective technique that reduces one of the popular compression technique is dictionary based the data storage and also increases the data transfer rate during compression. The dictionary contains a list of strings of communication. This paper explains a new method of lossless text possible symbols stored in a table like structure. It uses the compression technique for Tamil documents made of Unicode index of entries to represent larger and repeated dictionary Tamil characters. The method of compression and decompression process using static dictionary compression word or character by a smaller one [1]. The dictionary scheme is presented. This compression technique reduces the compression can be a static or dynamic scheme type. In this Tamil document an average of 50% of its storage capacity. The paper, the compression technique is based on a static original document is retained in the decompression process. dictionary which is easy and a permanent one. This static dictionary contains the subset of all the common pattern of Keywords-Text compression, decompression, Unicode and Unicode Tamil characters indexed by ASCII characters.
    [Show full text]
  • Text File Text File Example Text Reading Overview
    CS106A, Stanford Handout #53 Fall, 2003-04 Nick Parlante Files Text File The simple "text file" is one of the oldest and simplest types of file. For that reason, text files are one of the most universally standard ways to store information. A text file is something you could type up in a word processor, and save with the "plain text" option. A text file is made of a sequence of characters, organized as a series of horizontal lines of text. There is no notion of bold or italic or color applied to the characters; they are just plain text characters, as we would store in a String. Historically, text files have been made of the familiar roman keyboard alphabet – abcdef..xyz012..89!@#$.. – with the extremely standard ASCII encoding (American Standard Code for Information Interchange). More recently, text has grown to include the idea of unicode characters like ø and !, but the encodings for those are not yet as standard as ASCII. The .java files where we write our Java code are examples of text files. The text file is such a simple, flexible way to store information, it will be with us for a long time to come. If you want to store information in a simple, non-proprietary way, the text file is a great choice. XML files, which are a very modern way to store information, are a type of text file. Text File Example This is the first line of my 4 line text file, and this here is the 2nd. The above line is blank! The above example text file is 4 lines long.
    [Show full text]
  • Troubleshooting Text File Uploads
    Troubleshooting Text File Uploads In the HPMS, in the DIR module, there are a number of places that Sponsors are required to upload a tab-delimited text file. The files are validated against a set of rules, and if successful the data are unloaded into the HPMS database. Sometimes creating a valid tab-delimited text file can be a challenge. This document provides some tips for troubleshooting some common issues. Common ways errors are introduced Before beginning, be aware of the methods that commonly introduce errors. 1. Using an incorrect template is a common issue. Users should always download a current template from the HPMS before they begin. Templates change from year to year and are unique for each year. Creating a template rather than downloading the official template can introduce unknown issues. For Response Tables, entering data into the blank template instead of using the partially pre- populated version (available from Download Response Table Templates) introduces more risk. 2. Using word editors (e.g., Microsoft Word) to build a data file that is then copied into the excel template, or directly into a text file. Word editors use imbedded formatting and they can introduce characters or other formatting that is not supported. If possible, data should be entered directly into template rather than via copy and paste. 3. Saving as an incorrect type of text file. Only tab-delimited, PC format, ANSI encoded files are supported. Other types of text files are NOT supported (e.g., Unicode, MAC, binary, etc.) a. You can check the type and format by opening your file in your text editor (e.g., TextPad, Notepad,etc.) the select File > Save As.
    [Show full text]
  • Plain Text & Character Encoding
    Journal of eScience Librarianship Volume 10 Issue 3 Data Curation in Practice Article 12 2021-08-11 Plain Text & Character Encoding: A Primer for Data Curators Seth Erickson Pennsylvania State University Let us know how access to this document benefits ou.y Follow this and additional works at: https://escholarship.umassmed.edu/jeslib Part of the Scholarly Communication Commons, and the Scholarly Publishing Commons Repository Citation Erickson S. Plain Text & Character Encoding: A Primer for Data Curators. Journal of eScience Librarianship 2021;10(3): e1211. https://doi.org/10.7191/jeslib.2021.1211. Retrieved from https://escholarship.umassmed.edu/jeslib/vol10/iss3/12 Creative Commons License This work is licensed under a Creative Commons Attribution 4.0 License. This material is brought to you by eScholarship@UMMS. It has been accepted for inclusion in Journal of eScience Librarianship by an authorized administrator of eScholarship@UMMS. For more information, please contact [email protected]. ISSN 2161-3974 JeSLIB 2021; 10(3): e1211 https://doi.org/10.7191/jeslib.2021.1211 Full-Length Paper Plain Text & Character Encoding: A Primer for Data Curators Seth Erickson The Pennsylvania State University, University Park, PA, USA Abstract Plain text data consists of a sequence of encoded characters or “code points” from a given standard such as the Unicode Standard. Some of the most common file formats for digital data used in eScience (CSV, XML, and JSON, for example) are built atop plain text standards. Plain text representations of digital data are often preferred because plain text formats are relatively stable, and they facilitate reuse and interoperability.
    [Show full text]
  • Javascript Write to Text File
    Javascript Write To Text File Obadias unhooks feloniously while demiurgeous Charles garden lots or outgush fleeringly. Unlabouring Henrie sometimes rainproofs any chargeableness stockade facultatively. Noncontagious and extremest Richie blows achingly and uprise his threshers bombastically and erectly. Working on php controller errors, or more content, then it is that deno is used with javascript to write text file system Hide any error messages previously rendered. Youtube Channel for other interesting tutorials or game the comment below list you violate any questions or feedback. How simple javascript or writing log console logs, write position in node is no need. After long reading operation is finished, copy and paste this URL into your RSS reader. You may only want part of the window to be a drop surface, you probably need to open fine before writing to it. The encoding to be used when writing to the file. Insults are not welcome. If the file already has something in it, tutorials, as the link element can have an onclick attribute. This file is for testing purposes. Accept input from the command line in Node. Read a specified number of characters from a file. This code works only on Internet Explorer. If you will learn rust? Please can not write position in. So if i was to populate it inside a Lisbox. Sorry control the delay. Conditional Statement in Python perform different. It will write logs, just added data. Use writable streams instead. It means the page were already refreshed once but lia. PHP, a string specifying the command to execute. Scripting Engine, the browser would otherwise navigate far from your herd and mop the files the user dropped into the browser window.
    [Show full text]
  • Secrets of Powershell Remoting
    Secrets of PowerShell Remoting The DevOps Collective, Inc. This book is for sale at http://leanpub.com/secretsofpowershellremoting This version was published on 2018-10-28 This is a Leanpub book. Leanpub empowers authors and publishers with the Lean Publishing process. Lean Publishing is the act of publishing an in-progress ebook using lightweight tools and many iterations to get reader feedback, pivot until you have the right book and build traction once you do. © 2016 - 2018 The DevOps Collective, Inc. Also By The DevOps Collective, Inc. Creating HTML Reports in Windows PowerShell A Unix Person’s Guide to PowerShell The Big Book of PowerShell Error Handling DevOps: The Ops Perspective Ditch Excel: Making Historical and Trend Reports in PowerShell The Big Book of PowerShell Gotchas The Monad Manifesto, Annotated Why PowerShell? Windows PowerShell Networking Guide The PowerShell + DevOps Global Summit Manual for Summiteers Why PowerShell? (Spanish) Secrets of PowerShell Remoting (Spanish) DevOps: The Ops Perspective (Spanish) The Monad Manifesto: Annotated (Spanish) Creating HTML Reports in PowerShell (Spanish) The Big Book of PowerShell Gotchas (Spanish) The Big Book of PowerShell Error Handling (Spanish) DevOps: WTF? PowerShell.org: History of a Community Contents Secrets of PowerShell Remoting ..................................... 1 Remoting Basics ................................................ 3 What is Remoting? ............................................ 3 Examining Remoting Architecture .................................. 3 Enabling
    [Show full text]
  • Luno Tools Run Command Documentation Page 1/6
    Luno Tools Run Command documentation Page 1/6 Luno Tools Run Command Description Run Command aims to be a user-friendly way to run command line applications, command line system calls and single line shell scripts. Setup 1. Build a working command outside Switch It is important to start with a command which achieves your task and which needs to work outside Switch. On Mac, this means you build and test the command in the Terminal App. On Windows, you build the command in “Command Prompt” (Cmd.exe) or “Windows Powershell”. By example, we can build a command which retrieves the permissions of one file and stores it in another file. On mac we can achieve this using the following command: ls -l /path/to/inputfile.txt > /path/to/outputfolder/filename.txt And on Windows Command Prompt using this command : icacls -l C:\path\to\inputfile.txt > C:\path\to\outputfolder\filename.txt If you have issues with your command at this stage (you don’t achieve the output you want, you have errors, …), then the issue is not related to the “Run Command” app itself. The people with the most knowledge about your issue are the people who are expert at the command line application, command line system call or shell script you are trying to use. Usually, there are help pages, support forums, support people specific for these applications who can help you. Alternatively, you can also ask help on the Enfocus forums. 2. Handle spaces correctly When working with these kinds of commands a space is used to separate different parts of the command, by example a space is placed between the command name and the path to the inputfile.
    [Show full text]