Interpreting Binary Data Computer Crime Interpreting Binary Data

Interpreting Binary Data The Easy Stuff First The ‘Feel’ of the Data Data Profiles File Signatures

The Easy Stuff Pattern Matching Regardless of the meaning of the information sought, all digital information is simply a pattern of bits. By identifying the presence of the unique pattern of bits that corresponds to that decoded data, we can match the evidence drive with the illicit information.

The Easy Stuff Simple Searches Finding matches to known pattern, whether they form: the first portion of a child pornography specimen (a picture previously known to law enforcement) or the name and social security number of an identity theft victim.

The Easy Stuff The user has to interpret the binary data too. It is unlikely that the user will obscure the format in more than the most minimal way. File extensions usually indicate the contents of the file. If they do not, there are other methods to determine a file type (discussed later). The surrounding files or directory structure may give a clue as to the file’s contents.

The Easy Stuff What is USSCole ?

The ‘Feel’ of the Data The is almost always a text editor handy. Some details help may be available by simply looking at the file with a text editor. If the file contains text, it will be readily apparent. Even executable files (program files) often contain text to issue errors or prompts to the user. If nothing else, learn how to use ‘vi,’ a UNIX text editor.

The ‘Feel’ of the Data What is USSCole.txt ?

The ‘Feel’ of the Data Even without any text, certain consistent patterns in the file header may be recognizable. In this case, “ÿØÿà JFIF” identifies this file as a jpeg.

The ‘Feel’ of the Data Illustration

Data Profiles Using a commonly available tool called a hex editor, it is possible to examine the byte structure of a file. This technique can be especially useful when only fragements of a file can be recover (e.g. from slack space). WinHex is a full featured hex editor with a graphing feature that allows the user to generate a histogram of the frequency of byte patterns found in a file.

Data Profiles There are 256 possible byte patterns 1 byte = 8 bits 28 = 256 The histogram contains 256 lines (if each byte is present). The line on the far right, represents a null byte (00xh), blank, or white in an RGB encoded graphic. The line on the far left represents a full byte (ffxh), the “ÿ” character, or black in an RGB encoded graphic.

Data Profiles 00xh Most Common Byte (2.82%) Example FFxh

Data Profiles Illustration The original file is a true color bit map image. It is 235KB. It is 320 x 238 pixels. Illustration

Data Profiles 00xh FFxh Example

Data Profiles Illustration The original file is a true color bit map image. It is 80KB. It is 321 x 249 pixels. Illustration Notice the color blocking as fewer colors are available for transitions.

Data Profiles Example 00xh FFxh Compressed data distributes relatively evenly across all byte values.

Data Profiles The original file is a “zipped” (compressed) file. Compression works by calculating new coding for frequently occurring patterns. The better the compression, the more homogenous the file. Compression also obscures bit patterns (possibly confusing simple searches). Most forensic packages can deal with compressed files. The file is called “sniffer.zip” The file is 2,108 KB

Data Profiles 00xh Example FFxh

Data Profiles The original file is an executable file (a program). There are no zero occurrence bytes. The profile is unevenly distributed, but the spikes will be different for different executables. This file is part of the contents of the zipped file examined earlier. The original file is called Analyzer.exe The original file is 1,304 KB

Data Profiles JPG is a compressed format. Byte-patterns are wide-spread and have a cyclic pattern. 00xh Example

Data Profiles Illustration

Data Profiles JPEG images are compressed and show a wide distribution of byte values. The abundance of null values and large spikes (relative to non-image compression formats) mark jpeg and related image formats. Example

Data Profiles The original file is a JPEG It is 14,369 KB. This satellite photo of the WTC site was released by the National Reconnaissance Office.

Data Profiles Example

Data Profiles Example

Data Profiles The original files are MP3 encoded songs. (Each was legally obtained.) Like other compressed formats, the distribution is relatively even; however, single-byte “spikes” representing control elements of the MP3 can be seen. Distribution differs with the type of music encoded.

Data Profiles Individual byte values in text files each represent a letter, number, or punctuation mark. The space character will typically be the most common. The lowercase “e” will also be common. Example

Data Profiles This is the same text file as the previous example. It is encoded in Unicode. English text does not use the expanded capacities of Unicode so the most common byte value is the blank (unused) byte that follows each information byte. In this case, the blank byte accounts for 49.85% of the file. Example

Data Profiles Example Lowercase “a” “z” Space “e” “t” Uppercase “A” “Z”

Data Profiles The original file is a flat, text file called Digital Crime, Digital Terrorism, encoded in the American National Standards Institute (ANSI) standard (an ASCII superset). It contains three chapters from my book.

Data Profiles Example

Data Profiles Example