linux Forensic question"Signature mismatch help"

Tools are only tools. Most work but sometimes there will be issues.

As part of your learning skills you should be able to go down the the raw level of data to establish if the tools are giving the correct results. For instance a JPEG file will start 0xFF 0xD8 0xFF then 0xE0 or 0xE1. This is easy to determine using a hex editor. With all forensic examination I think you must be able to justify the result a certain tool may have produced.

A Zip file starts "PK"

The demo of my software (www.cnwrecovery.com) will display in the log signature found and extension found, so mis matches can be found. Most similar programs rely on a data base of signatures - some can be edited by the user, some are fixed.

Some file structure have the same basic signature for many file types, eg .EXE, .DLL, .OCX Another one is the current Office 2007 are all Zip files. To determine if a .DOCX or .XLSX the file has to be unzipped and the XML data examined. A signature sometimes needs to be more than just a match of a few bytes.

Thanks for the quick reply mscotgrove, So its a manual process in Linux?.

I was hoping there was a tool which I run at all files within the raw image and verify the file signature - similar to that in encase.

I dont mind doing this manual process on a small number of files but what if I have a large number of files to analyse using a Linux forensic tool. (I am trying to use the terminal by the way to carry out all my analysis)

Kaly…

I have a number of files which have signature mismatches jpegs as Zip's etc..

That – signature mismatch – is a Windows thing. Windows uses extensions to decide what the file is.

Linux doesn't do anything like that – in Linux the file names/extensions do not have any such connection, except as far as the user names the file according to his/her preferences.

For that reason, Linux tools may not be the right thing to use.

Anyway, check file(1). It looks at an unknown file, attempts to identify the file format, and then print out a report of what it find. You can invoke it for multiple files.

Kaly,

You mis understand what I am trying to say. Do use tools, but at the same time, do try some manual tests. A manual test will show you the raw data, and then let you determine if the tool you try is generating the correct signature / extension data. If you are then confident that the data and signatures are correct, a tool will probably produce the best results. However, never just rely on a tool, there are always possible cases of false positive matches, and sometimes mis-matches. Get to know what the raw data looks like.

Thanks for the response mscotgrove, Made my way through the raw data as suggested..

Kaly..

Just in case.
Trid
http//mark0.net/soft-trid-e.html

jaclaz

Just in case.
Trid
http//mark0.net/soft-trid-e.html

jaclaz

Hadn't seen this site before. Thanks for the link.

Linux doesn't do anything like that – in Linux the file names/extensions do not have any such connection, except as far as the user names the file according to his/her preferences.

athulin, I agree.

Just in case.
Trid
http//mark0.net/soft-trid-e.html

jaclaz

Jaclaz, I hold mark0 software in my software arsenal.

Jaclaz, I hold mark0 software in my software arsenal.

..which is good ) , but have you actually explored the site?
like finding wink
http//mark0.net/soft-trid-deflist.html
http//mark0.net/soft-trid-deflist-j.html
http//file-extension.net/seeker/file_extension_jpg

and the tridscan (that allows for "automatical patterning" of *any* file type if you give it enough "examples")?
http//mark0.net/soft-tridscan-e.html

and that you can quickly check a file online?
http//mark0.net/onlinetrid.aspx

and that the tridnet triddefs_xml.rar is a set of "plain enough" .xml files that you can check for patterns/filetype?
http//mark0.net/soft-tridnet-e.html

and BTW, though we all have "better" tools, I have rarely found something as useful and "quick" as
http//mark0.net/soft-minidumper-e.html

and even the "bovine" scanner is sometimes handy
http//mark0.net/soft-bdllscan-e.html

jaclaz