Printable View
Question-
Short of acquiring my hard drive into EnCase, does anyone know a way to compare file signatures with their extensions? ie: Trying to find out if a file's extension is a match to the file's header?
Forensic Preservation is not an issue here.
Looking for possibly a program that would search the HDD and compare extensions to headers, then give me a report of mismatches.
Thanks for the help.
One of the tools in ProDiscover does that, but I can't think of anything free (which is what I'm assuming you are looking for)
But now that I think about it, how hard would it be to write a little app that would do it? The data sig is in the first 20 bits, and compare it to the file extension. Sounds like that may actually be a fun little project.
Link for ProDiscover: http://www.techpathways.com/DesktopD...dex=3&tabid=12
Hmm, that would be a fun little project. On *nix there is a command-line tool called file which identifies file-types. So it would be a matter of a good script that sends the right arguments to file and comparing that against a list of extenstions.
As with all utilities check for any know exploits on the version you are using and update to the safe version.
Whoohoo, score one for SourceForge.
The unix file utility for Windows:
http://gnuwin32.sourceforge.net/packages/file.htm
You might find other fun utilities from the rest of that project:
http://gnuwin32.sourceforge.net/
So really, it would still be a matter of writting some kind of script that compares the results from file to the extension of the file in question and returns true or false appropriately.
Ofcourse, as it's a sourceforge progect, you could just edit the code and make your own utility.
Hope that helps,
Dhej
Cool..good info there. Thanks Dhej.
I was actually thinking of doing it in Java and see if I really learned anything in my computer science classes ;) Might as well make it cross platform :D
I might tinker with that as soon as finals are over. I need to have a little project anyway, or I'll have coding withdrawal (no Gore, not codeine :jester: )
I'm having trouble formulating a concise question here, so hopefully if I ramble enough, someone will understand what I am getting at, and be able to render an opinion.
There are one of two ways I can parse the extension from the file listing. Neither way is difficult. I can either find the end of the string, and pull the last 3 letters (ie. create a new string txt from test.txt), or essentially starting from the end of the string and working backwards.
Or I can start from the beginning of the string, search until I find the '.' before the extension, and create new string from everything after the '.'. It's two ways to skin a cat.
The reason for comparing an extension against the file signature is to make sure the file extension has not been altered to "hide" info, but what about the case where there is a double extension, as in (for example) a malicious script that looks like "C:\Good_File.txt.sys"...
Here's where the confusing part comes in. If I have my computer set to "Hide extensions for known file types", a malicious file named "test.txt.sys" is going to appear as "test.txt", making it look like a harmless text file.
Ok, still with me? If I parse the text string from the right, I'll get a string holding "sys", and when it compares it to the file signature, it is going to pass, because the file will have the proper signature. If I parse from the left, I will end up with a string holding "txt", which when compared to the signature, will generate an error.
So the question is, what is the name of the bus driver?? :jester:
By my little bit of logic, I want to compare the first extension with the file signature. I can't think of any case where we would ever want to check the second extension, in linux or windows. Am I correct in my logic? Does anybody really care? Will Batman escape from the clutches of the evil Penguin? Stay tuned?? :D
IMHO go for the second option. Then check the new string for double extensions. If there are. Give the user a warning or something(mutiple extensions could point to malware) and then check all those extensions.
I for one would love to know if a file had the extensions .txt.sys that it was a .sys and not a .txt instead of yust knowing if its not a .txt
I don't but can't you get the program to change the option of not showing the extension when you start it and then restore this option to the way it was when the program ends. I think this is .reg stuff but I don't know for sure.
But its your project.
Surely a more precise way of doing it would be to pass each string through first to determine how many periods there are. IMO, more than one is suspicious in the first place. Those that have multiples should be logged with their complete path and passed over for future investigation. Then start from the left and find the period and cut the remainder of the string as the extension since not all are 3 characters, (html comes to mind), you would cause an error if you only pull the last 3.
My 2 cents.....
Thanks MoonWolf & Tiger, that was my 3rd option... (checking for double extensions)
/in my best Homer Simpson voiceQuote:
(html comes to mind)
DOH!!
/slaps self on forehead.
I'm not sure I understand... why wouldn't you want it to show the extension? I can disable it in explorer, but Java shows the full path and extensions, regardless of how explorer is set.Quote:
I don't but can't you get the program to change the option of not showing the extension when you start it and then restore this option to the way it was when the program ends.
Doh!
me==stupid. I should think then write.
Even though you're doing this in Java, there's a C function strtok that comes to mind when discussing this. Were I to write a program like this, I think C strtok would be a nice choice because then I could check for all the extensions that are present in the file name (not limited to just finding two). I don't know enough java to know if there's a method that's equivalent to strtok, but if there is, I would suggest going with that instead of having to write your own method to handle it.
Thanks for the input FlamingRain. Actually, it was pretty easy to do, I just wanted to make sure I wasn't missing any conditions (as Tiger pointed out, html has 4 letters in the extension).. actually checking for more than one extension only took a few lines of code.
public static void checkDouble()
{
for (int h=0; h<filePathString.length(); h++)
{
if ( filePathString.charAt (h) == dot )
{
count = count + 1;
} // end of if
} //end of for
if (count>=2)
{
System.out.println("There is a double extension"); // Error marker for later development
}
} // end of checkDouble
I don't mind creating new classes and methods, I'm sure I'll be able to use them later.
Ok, here I go, bringing up a slightly old thread...
I've got most of this sucker put together... the GUI needs to be prettied up a bit, and I have a comparison routine to put together yet, that shouldn't take too much longer.
I need a little input from the AO community... I need as many lists of file signatures as I can possibly get. The one I am using is here: http://www.garykessler.net/library/file_sigs.html
If anybody knows of any other lists like this, it would be very helpful. The tools is going to be cross-platform, so signatures for any OS are usable.... I suppose I could generate different tables for different OS's if need be...
Cheers and Beers!!!
Ok, here I go, bringing up a slightly old thread...
I've got most of this sucker put together... the GUI needs to be prettied up a bit, and I have a comparison routine to put together yet, that shouldn't take too much longer.
I need a little input from the AO community... I need as many lists of file signatures as I can possibly get. The one I am using is here: http://www.garykessler.net/library/file_sigs.html
If anybody knows of any other lists like this, it would be very helpful. The tools is going to be cross-platform, so signatures for any OS are usable.... I suppose I could generate different tables for different OS's if need be...
Cheers and Beers!!!
Hmm, I just thought of something groovicus...
When I program php I often end up doing with files named "foo.class.php" or "bar.inc.php", but then that brings up another issue..., html, php, javascript are all really .txt files...
Anyway, I'm impressed with your effort. I'll keep my eye out for anything I see that's useful for your task.
Peace,
Dhej
Thanks Dhej, I had already thought of that, so I had to rethink my strategy a little bit. A few members here helped me refocus my efforts, and things are progressing (slowly) but well.....
In the event of a double extension, the file signature will still be checked. If it shows as a text file, then no biggie. If not, it will be dumped to a log. What I am most concerned is noting a file that is labeled a text file, but has the sig of an exe or bat or something.....