File Type Identification for Digital Forensics

Abstract

Abstract. In modern world the use of digital devices for leisure or professional reasons (computers, tablets and smartphones etc.) is growing quickly. Nevertheless, criminals try to fool authorities and hide evidence in a computer or any other digital device, by changing the file type. File type detection is a very demanding task for a digital forensic examiner. In this paper a new methodology is proposed -in a digital forensics perspective-to identify altered file types with high accuracy by employing computational intelligence techniques. The proposed methodology is applied in the four most common types of files (jpg, png and gif). A three stage process involving feature extraction (Byte Frequency Distribution), feature selection (genetic algorithm) and classification (neural network) is proposed. Experimental results were conducted having files altered in a digital forensics perspective and the results are presented. The proposed model shows very high and exceptional accuracy in file type identification.

Hierarchy Website Fingerprint Using N-gram Byte Distribution

“…In this section, 1-gram, 2-gram, and 3-gram is implemented in search news websites as it is shown in the following table (3). It can be noticed from Table 3 that the accuracy is significantly increases as going from low gram to higher one.…”

“…For example, in a normal forgery case we might be concerned in the content of the packet itself sent through the network rather than how the packet was sent (e.g. using instant messenger, email or web pages) [3]. Website fingerprint is an attack of traffic analysis running by a local eavesdropper, its goal is to infer information about the visited website by user by defining a feature of data flow.…”

Fragments‐Expert: A graphical user interface MATLAB toolbox for classification of file fragments

“…Another practical application of file fragment classification is computer forensics and investigations. In this case, during the recovery and examination of given evidence, the examiner may deal with a collection of fragments with no available file system information [2,[4][5][6][7][8][9]]. The third practical example is the file recovery process during which the file system structure is damaged or deleted [10][11][12].…”