File type identification tools for digital investigations

Adrien Dubettier (1) , Tanguy Gernot (1) , Emmanuel Giguet (1) , Christophe Rosenberger (1)

1 Equipe SAFE - Laboratoire GREYC - UMR6072

Digital forensics is the process of identifying, preserving, analyzing, and documenting digital evidence for investigation purposes. Building or using file analysis tools is of great interest for a forensic expert to collect high-level information in a short time. In this paper, we consider the examination of files contained in digital media, especially files with possible incorrect types. This often reveals a simple way to hide sensitive content such as porn images, passwords, or accounts. Many commercial and free forensic tools are available for file type identification (FTI). In this work, we assess the performance of ten of them on two significant datasets and scenarios. The main issue we address is the relevance of the tools for forensic purposes. The underlying question is: do expectations meet reality? Our experiments highlight the significant disparity in the accuracy and behavior of the studied tools.

Keywords: Digital forensics; Digital evidence assessment; Comparative evaluation of forensics tools; Benchmarking; File type identification; File systems

Domains: Cryptography and Security [cs.CR]

Adrien Dubettier, Tanguy Gernot, Emmanuel Giguet, Christophe Rosenberger. File type identification tools for digital investigations. Forensic Science International: Digital Investigation, 2023, 46C, pp.301574. ⟨10.1016/j.fsidi.2023.301574⟩. ⟨hal-04128864⟩