Cyber Crime and Cyber Terrorism

66
CHAPTER 6
High-tech investigations of cyber crime 
SIGNATURE ANALYSIS
It is easy to obscure a files’ true meaning, and it useful to identify whether all the files 
are what they purport to be; this can be a simple way of highlighting notable files. 
Operating systems use a process of application binding to link a file type to an appli-
cation. Windows, for example, uses file extensions and maintains a record of which 
application should open which file: for example .doc files are opened in Microsoft 
Word. The fact that Windows uses file extensions gives rise to a data-hiding tech-
nique whereby a user can change the extension of the file to obscure its contents. If 
a file named 
MyContraband.jpg
was changed to 
lansys.dll
and moved to a system 
folder, the casual observer would probably never find it.
Linux uses a files header (or signature) to identify which application should 
open the file (the file can be viewed in hex to see this). It is therefore harder to 
obscure a files’ contents/true type as with a broken header the file will often not 
open. Linux (and Mac) have a built-in Terminal command that allows you to iden-
tify a file’s signature, simply using the command 
file –i
[where 
–i
represents the 
input file].
Most Forensic tools have the capability to check a file’s signature and report 
whether this is different from that expected from the extension. The file’s signature 
can be checked against a precompiled database. If the signature exists it will then 
check the extension associated with it. One of the following results for each file will 
then be obtained (certain forensic tools may give more specific results but all align 
to the same two concepts):
• 
Match
- the signature and extension match with what is stored
•