Rabu, 25 Desember 2013

How to know the real extension of a file?

In computer forensic challenge we usually work with a file with no extension like the file in red rectangle below
The next question, how we can know the real extension of those files?
If you want to know the real extension of those files the first thing you can do is check the "file signature" from those files.
what is file signature?
 a file signature is data used to identify or verify the content of a file. In particular, it may refer to:
  • File magic number: bytes within a file used to identify the format of the file; generally a short sequence of bytes (most are 2-4 bytes long) placed at the beginning of the file (wikipedia)
     1 byte = 8 bits = 2 Hex
     2 - 4 bytes = 4-8 hex
to know the "file signature" a file the first thing you can do is check the hex value of that file (because most of file signature is stored as hex value on database),
to do this you can follow this steps:
1. download this tool "HxD Editor"
http://www.softpedia.com/get/Programming/File-Editors/HxD.shtml
2. after download, just install and open it.

3. open the file you want to know the real extension (click menu File --> Open)

4. copy first 4-8 hex value from HxD Editor
in example we copy first 6 digit Hex value : FF D8 FF
5. find file signature database in internet, like this one
http://en.wikipedia.org/wiki/List_of_file_signatures
the other file signature database:
http://www.garykessler.net/library/file_sigs.html
http://www.filesignatures.net
6. rename the file with real extension

ta daaaa :)
For your exercise please find the right extesion for "Mocca" file :D
this is the file that you can download.


Tidak ada komentar:

Posting Komentar