Skip to content

File analysis

File analysis is the process of examining the contents of files on a storage medium, as distinct from the analysis of the file system that organizes them. It is an important part of computer forensics, and spans the whole spectrum from determining what a file actually is, via file format identification, to extracting and interpreting its content, to understanding the behavior of executable files, to the analysis of files shared over peer-to-peer networks.

The term "file analysis" is frequently used to mean file format identification or simple string searching, but it really covers the whole range of techniques for examining what a file contains and what a program contained in a file does.

More fundamentally, file analysis is a process of inference: the investigator reconstructs the origin, content, and use of a file from its observable features - the strings it contains, the structures it follows, the calls it makes when it runs. Every recovered observation is therefore a hypothesis, whose reliability grows the more independent observed features corroborate it.

File format identification

Determining the actual type of a file from its content - magic numbers, headers and footers, internal structure - rather than from the name or extension it carries, which its creator (or an adversary) supplied. This is the foundation for all further analysis of an unknown file, and must work even when the file system metadata is missing or unreliable.

See also File Format Identification and File format identification tools.

Content analysis

Extracting meaningful content from a file: printable strings in text or binary data, text and layout information inside documents, and embedded or hidden data. Content analysis works on files of known or unknown format and is often the first pass over a suspicious file.

See also Strings analysis and File analysis tools: content analysis.

Executable file analysis

Analysis of executable files, both statically (headers, formats, dependencies) and dynamically (tracing the system calls, library calls, and other behavior a process makes when it runs). These same techniques underpin malware analysis, where the goal is to understand what a malicious program does.

See also Portable Executable format, Analyzing program execution and File analysis tools: executable file analysis.

Code comparison

Comparing source code and object code to measure similarity, used to detect copyright infringement and trade secret theft, and also of use in attributing related code to a common origin.

See also CodeSuite.

Artifact parsing

Parsing structured artifacts produced by applications - Recycle Bin entries, browser cookies, mail, office documents - each in its own documented or ad-hoc format, which often carry user data and traces of activity even when the application itself is no longer in use.

See also File formats, Residual data in document files, Document metadata extraction and Logfile analysis.

File sharing analysis

Examining the files and traces left by peer-to-peer file sharing applications, including the files shared on disk and the metadata the application records about them.

See also P2P Marshal.

Email and structured file viewers

Examining the files of structured stores used by mail and database applications - PST, EDB, OLM, MBOX, MSG - with dedicated viewers, converters and repair tools; often the only way in when the application's own mailbox file is corrupted.

See also Email and structured file viewer tools.

Windows environments

Because so much evidence comes from Windows systems, Unix-like analysis tools are frequently run under an emulated Unix environment on Windows.

See also Cygwin and File analysis tools: Windows environments.

See also