.

Filetypes and encryption

<<

pomi

Newbie
Newbie

Posts: 4

Joined: Sat Mar 13, 2010 3:27 pm

Post Sat Mar 13, 2010 4:05 pm

Filetypes and encryption

Hi Guys,

I have two questions:

1. Whilst assessing a raw drive image, how do you determine the filetypes of files. Its easy to ID a text file for example since its visible in plaintext and same with images/videos etc as they have meta tag information at the beginning of the file, but then you have files which are just complete gobbledygook. How does one determine the filetype of such files ?

2. Ive been looking into various encryption algorithms and want to know if there any established way of determining what encryption a file is using (when assessing the raw output of file).
<<

mambru

Jr. Member
Jr. Member

Posts: 98

Joined: Wed Jun 03, 2009 3:11 pm

Post Sat Mar 13, 2010 5:46 pm

Re: Filetypes and encryption

Hi pomi, regarding your questions:

1) In digital forensics there is a technique called data carving, which takes raw data as input and tries to detect/recover files. The are quite a few tools out there doing it, right know the only name I remember is Scalpel, but I'm pretty sure some live cd's for forensics, such as Helix, contains some of these tools.

2) A good algorithm shouldn't give anything away about how a file was encrypted (note I'm not saying an encryption algorithm should be driven by "obscurity"), so you shouldn't expect to see certain frequencies or traits that allow you to pinpoint the algorithm used. But, there could be cases of bad implementations that somehow do it.
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Sat Mar 13, 2010 7:12 pm

Re: Filetypes and encryption

Hi pomi,

1. There are really two kinds of files, plain text and binary.  As you have already realized, text files are easily recognizable.  Binary files typically have a header and a footer element that identifies the file.  The header or footer are just a series of characters that are going to be common to all files of that type.  When you are looking for a file, you can search for a particular header to identify the beginning of a file.  Identifying the end can be somewhat more challenging though.  If the file doesn't have a footer, you can just cut chunks of a certain size and hope that the native software viewer can reconstruct the file using error correction. 

For example, a windows executable has a header signature of 4D5A. 

Like mambru said, data carving software will look for file headers.  Typically you set the headers you are seeking and a target file size.  The software will search for the header and copy out data chunks of the size you specified. 

The above is assuming that you don't have access to the file system table.  Most forensic software can interpret the file system type and its table of files and folders.  Rather than relying on file signatures, the software will simply reconstruct the directory and file structure. 

2. Some encryption protocols will include a header to identify itself.  Some will not.  In forensics, we get used to looking at data in hex.  If we see a long stream of hex without any recognizable text, it could indicate encryption or some sort of encoding, but it isn't always the case. 
~~~~~~~~~~~~~~
Ketchup
<<

pomi

Newbie
Newbie

Posts: 4

Joined: Sat Mar 13, 2010 3:27 pm

Post Sat Mar 13, 2010 9:42 pm

Re: Filetypes and encryption

Thanks guys. Do you have any tool recommendations (*nix and windows) ? ATM I am using winhex.

Moving on, I was messing around with a RIFF file and changed some of its hex values. As a result the file would not play in some players and in others like VLC I was requested to 'repair' the file before it could be played. If I make a change to a file, what other values need to be adjusted in order for it to work ? I presume it has something to do with MFT.

Also, I have been trying to workout a way to read remapped sectors (at the moment in NTFS). Is there any way this can be done ?
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Sat Mar 13, 2010 11:42 pm

Re: Filetypes and encryption

Scalpel is a great data carving tool like mambru mentioned.  Of course, EnCase, X-Ways, FTK all have these capabilities and much more.  These are commercial and expensive tools though.

If you change data in a binary file, you are changing the structure of a file.  This has nothing to do with the MFT.  Each binary file will have its own structure as set forth by the developer.  Check the following article on the RIFF file structure:

http://www.tactilemedia.com/info/MCI_Control_Info.html

By remapped sectors, do you mean those moved the HDD firmware when bad sectors are discovered?  If so, you would need specialized hardware + software solution that allows access to the HDD firmware.  There are two such products that are popular.  One is from SalvationData and the other is from ACE Labs. 
~~~~~~~~~~~~~~
Ketchup
<<

pomi

Newbie
Newbie

Posts: 4

Joined: Sat Mar 13, 2010 3:27 pm

Post Sun Mar 14, 2010 10:07 am

Re: Filetypes and encryption

Ketchup wrote:If you change data in a binary file, you are changing the structure of a file.  This has nothing to do with the MFT.  Each binary file will have its own structure as set forth by the developer.  Check the following article on the RIFF file structure:

http://www.tactilemedia.com/info/MCI_Control_Info.html


I have that document lying around somewhere. Its a long read which is why I keep putting it off.
In theory, if I change a few hex values of the file it 'should' still work, but I am trying to workout what other areas need to be 'updated' so the file doesnt give an error when executed. Since VLC is able to repair the file this indicates that updating the values which manage the integrity of the file is possible. The only problem now is finding them.

By remapped sectors, do you mean those moved the HDD firmware when bad sectors are discovered?   If so, you would need specialized hardware + software solution that allows access to the HDD firmware.   There are two such products that are popular.  One is from SalvationData and the other is from ACE Labs. 


Yes, Im referring to bad sectors. I was planning on writing a tool which could read/extract data from bad sectors. I was really hoping I wouldn't need to hack/RE the firmware but it looks like that might be the only solution.
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Sun Mar 14, 2010 10:48 am

Re: Filetypes and encryption

Pomi,

Unless you strategically change a few hex values that are non-essential to the operation of a file, you are going to "break" the file.  Think of a binary file is a file system (some actually are).  It depends on which file you delete, whether or not the operating system will still boot.

The firmware area on a hard drive sits on the platters.  The issue is that hard disk controllers, not software, do not have access to this area.  A software tool alone will not be able to access the firmware.  What makes this even worse is that the access to this area varies from manufacturer to manufacturer.  For example, some Seagate drives make this area accessible through a custom serial interface.  None of this is well documented.  ACE Labs and SalvationData figured this out by reverse engineering and stealing engineers from the hard drive manufacturers :)
~~~~~~~~~~~~~~
Ketchup

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software