Week 10: File Signatures & Data Carving

File Signatures

File signatures are standardized strings of characters (bytes) that exist at the beginning (header) of certain types of files.

Some file types also utilize a string of bytes at the end (footer) of a file, to further define the “signature” of that file type.

Windows uses filename extensions (provided by a user or application) to identify the “type” of a file and to determine what application to use to open the file.

For quick and easy searches you may rely on filename extensions to find files of a specific type.

Other OSs (Linux, Mac OSX, etc.) use file signatures (headers) to identify the file type, regardless of what the filename extensions is. In fact files on those OSs have no need for a filename extension.

In Computer Forensics, the more comprehensive search for files of a specific type is through the use of “File Signatures.”

Searching by File Signatures

By searching for the known “header” of a file type, we can find any instance of the desired type of file, regardless of:

  • What the file is named
  • What its file extension is
  • Whether or not the entire file is present
  • If it is embedded within another file
  • Or any other example where searching using file system information would fail to find the file

By searching for the known “header” of a file type, we can find files that are named incorrectly (possibly in an attempt to hide them). (i.e. eventlog.dll is a renamed .jpg graphic file)

Basic Data Carving

Now that you understand and can perform searches for file headers, how do we extract an identified file if all file system information about the found file is missing?

You do not know how large the file is or what clusters originally contained the file.

You only found the beginning of a specific type of file…. now what?

Using trial and error guesswork, we cut out arbitrary size blocks of data, starting with the found header, and see what we get!

Basic Carving Techniques

File Headers

  • Search for string of Hex Values
  • Upon finding string crave (extract or copy out) a defined size block of data, unless
    • file type has a defined footer and…
    • carving tool finds footer before end of defined size, in which case stop at footer.
  • Evaluate results of carve, adjust carve size criteria up or down re-carve using new parameters.

File Footers

  • Upon finding a File Header, for any file type that has a footer, you may continue your search “from the current cursor position’ for the HEX values of the footer to attempt to find the end of the file rather than guess where the end of the file is.

Limitations

  • False hits
  • Assumptions:
    • Beginning of file is not overwritten
    • File is not fragmented
    • File is not compressed (i.e. NTFS Compressed)
  • Repeated carves of same data (ZIP)
  • Trial and error process
    • Do partial carved files open?
Advanced Data Carving

Many “Compound File Formats” contained detailed information about the file itself, withing the file.

By reading the content of a compound file, in many cases you can identify the size and components of the file.

This allows you to potentially carve out the exact file and not just an arbitrary size block of data.

Way beyond the scope of this course… see papers located at: http://old.dfrws.org/2006/challenge/index.shtml