Download presentation
Presentation is loading. Please wait.
Published byΒηθεσδά Γιαννόπουλος Modified over 6 years ago
1
File Extractor Pro’s File Signature Builder
File Carving Tools File Extractor Pro’s File Signature Builder © Dr. D. Kall Loper, all rights reserved
2
File Signature Builder
Premise A data runs in unallocated space were at one time an active file. Propositions The program that created the file created more than one file. This program need not be on the computer. At least two sample files are still active on the system. © 2012 Dr. D. Kall Loper & 2006 Core Digital Forensics Inc. all respective rights reserved
3
File Signature Builder
Match Sample Files FSB examines each file in the folders selected. The file must be larger the 32K or else it is skipped. At least two files are needed for a match. System files and “locked” files are skipped. © 2012 Dr. D. Kall Loper & 2006 Core Digital Forensics Inc. all respective rights reserved
4
File Signature Builder
Identify matching file signatures, Matching bytes at the beginning plus various trigger points within the file Create a list of all newly identified file signatures Search unallocated space for any of the newly identified file signatures © 2012 Dr. D. Kall Loper & 2006 Core Digital Forensics Inc. all respective rights reserved
5
File Signature Builder
Files system objects are gathered. Illustration © Dr. D. Kall Loper, all rights reserved
6
File Signature Builder
FSB creates an MD4 hash from the first 2.5 MB. If the file is smaller than 2.5 MB then whole file is hashed. Illustration © Dr. D. Kall Loper, all rights reserved
7
File Signature Builder
Files with duplicate hashes are removed from the analysis. Illustration © Dr. D. Kall Loper, all rights reserved
8
File Signature Builder
FSB looks for files with similar first 15 bytes. Unique files are excluded from the analysis. Illustration © Dr. D. Kall Loper, all rights reserved
9
File Signature Builder
FSB compares file signatures by stepping through each byte of the matching groups. Illustration © Dr. D. Kall Loper, all rights reserved
10
File Signature Builder
FSB creates a 'draft' list of signatures. Illustration © Dr. D. Kall Loper, all rights reserved
11
File Signature Builder
Unworkable or useless (all 00xh) headers are removed. Illustration © Dr. D. Kall Loper, all rights reserved
12
File Signature Builder
Using File Extractor Pro The signatures are added to the custom signature list in File Extractor Pro. © 2012 Dr. D. Kall Loper & 2006 Core Digital Forensics Inc. all respective rights reserved
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.