Mardown에 빠져서 새로운 블로그 팠습니다.


https://realsung.github.io/

'일상' 카테고리의 다른 글

새로운 블로그 주소  (0) 2018.09.13
앞으로의 계획  (0) 2018.08.27

통합 포렌식 도구 (Integrated Forensics Tools)

NameInterfacePlatformManufacturerLicence
EnCase ForensicGUIWindowsGuidance SoftwareCommercial
FTK (Forensic Toolkit)GUIWindowsAccessDataCommercial
Forensic ExplorerGUIWindowsGetDataCommercial
X-Ways ForensicsGUIWindowsX-Way Software Technology AGCommercial
Mac Marshal Forensic Edition™GUIMacintoshArchitecture TechnologyCommercial
BlackLightGUIAnywhereBlackBag TechnologiesCommercial
AutopsyGUIAnywhereBrian CarrierOpensource



라이브 CD/VM (Live CD/VM)

NameInterfacePlatformManufacturerLicence
SIFTSANSFreeware
PALADINSAMURIFreeware
DEFTDEFT StaffFreeware
Helixe-fenseCommercial
BackTrackBackTrack LinuxFreeware
C.A.IN.ECaineFreeware



라이브 포렌식 (Live Forensics)

NameInterfacePlatformManufacturerLicence
FPLive_winCLIWindowsJK KimFreeware
FRED (First Responder’s Evidence Disk)GUIWindowsDark Particle LabsFreeware
WFT (Windows Forensic Toolchest)CLIWindowsFoolMoonFree/Comm
Dual Purpose Volatile Data Collection ScriptCLIWindowsCorey HarrellOpensource
IRCR (Incident Response Collection Report)CLIWindowsmcleodjpOpensource
COFEE (Computer Online Forensic Evidence Extractor)CLIWindowsMicrosoftonly Law enforcement
MIR (MANDIANT Intelligent Response)GUIWindowsMandiantCommercial
OnLineDFS (OnLine Digital Forensic Suite)CLIWindowsCSTCommercial
MacResponse LE™GUIMacintoshAISOpensource



이미징 하드웨어 (Imaging Hardware)

NameInterfacePlatformManufacturerLicence
Image MASSter SeriesIntelligent Computer Solutions, Inc.Commercial
Dossier & FalconLogicubeCommercial
TD3TableauCommercial
MagicubeDataExpertCommercial



이미징 소프트웨어 (Imaging Software)

NameInterfacePlatformManufacturerLicence
FTK Imager (Lite)
CLI FTK Imager for Debian, Ubuntu, Fedora, RedHat, Mac OS.
GUIWindowsAccessDataFreeware
Tableau ImagerGUIWindowsTABLEAUFreeware
(need Tableau W/B)
X-Ways ImagerGUIWindowsX-Ways Software Technology AGCommercial
EnCase Forensic
Imager
GUIWindowsGuidance SoftwareFreeware
FAU DDCLIWindowsGeorge M. Garner Jr.Freeware
ODINGUIWindowsJensHOpensource
OSFCloneCLIWindowsPassMark SoftwareOpensource
ewfacquire, ewfacquirestreamCLIUnix-basedJoachim MetzOpensource
GuymagerGUILinuxvogu00Freeware
dcflddCLIUnix-basedNick HarbourOpensource
MacQuisitionCLIMacintoshBlackBag TechnologiesOpensource



쓰기방지장치 (Write Blocker)

NameInterfacePlatformManufacturerLicence
Tableau Forensic BridgeTableauCommercial
Wiebetech DockWiebetechCommercial



이미지 마운트 (Image Mounting)

NameInterfacePlatformManufacturerLicence
Arsenal Image MounterGUIWindowsArsenal ReconFreeware
Mount Image ProGUIWindowsGetDataCommercial
OSFMountGUIWidowsPassMark SoftwareFreeware
VHD toolCLIWindowsMicrosoftFreeware
LiveViewGUIWin & LinCMU/td>

Freeware
raw2vmdkGUIAnywhereZapotek/td>

Freeware
FTK ImagerGUIWindowsAccessDataFreeware
P2 eXplorerGUIWidowsParabenFreeware
ImDiskGUIWindowsLTRDATAOpensource



원격 포렌식 (Remote Forensics)

NameInterfacePlatformManufacturerLicence
F-Response SeriesGUIAnywhereF-ResponseCommercial



메모리 획득 (Memory Acquisition)

NameInterfacePlatformManufacturerLicence
DumpItCLIWindowsMoonSolsFreeware
win(32/64)ddCLIWindowsMoonSolsFree/Comm
FastDump ProCLIWindowsHBGaryCommercial
mddCLIWindowsManTechOpensource
Memorize (for Mac)GUIWindowsMandiantFreeware
FTK Imager (Lite)
CLI FTK Imager for Debian, Ubuntu, Fedora, RedHat, Mac OS.
GUIWindowsAccessDataFreeware
WinPmemCLIWindowsMichael CohenFreeware
fmemCLILinuxniekt0Freeware
LiMECLILinuxJoe SylveFreeware
Second Look® Linux Memory AcquisitionCLILinuxRaytheon PikewerksCommercial
Mac Memory Reader™CLIMacintoshMac Marshal™Freeware
OSXPMemCLIMacintoshMichael CohenFreeware



메모리 분석 (Memory Analysis)

NameInterfacePlatformManufacturerLicence
RedlineGUIWindowsMandiantFreeware
VolatilityCLIAnywhereVolatile SystemsOpensource
Memorize & Audit ViewerGUIWindowsMandiantFreeware
Responder ProGUIWindowsHBGaryCommercial
Second Look® Linux Memory AnalysisCLILinuxRaytheon PikewerksCommercial
VolafoxCLIMac OSn0fateOpensource
VolafunxCLIFreeBSDn0fateOpensource



타임라인 분석 (Timeline Analysis)

NameInterfacePlatformManufacturerLicence
log2timelineCLILinux & MacKristinn GudjonssonFreeware
plasoCLIWin & MacKristinn GudjonssonFreeware
4n6timeGUIWin & MacKristinn GudjonssonFreeware
TimelinerGLIWindowsWoanwareFreeware/Opensource
Timeline ReportGUIEnCase-BasedGeoff BlackOpensource



레지스트리 분석 (Registry Analysis)

NameInterfacePlatformManufacturerLicence
REGA(REGistry Analyzer)GUIWindows4&6techCommercial
Registry ReconGUIWindowsArsenal ReconCommercial
Registry WorkshopGUIWindowsTorchSoftCommercial
RegRipperCLIWindowsHarlan CarveyOpensource
UserAssistGUIWindowsDidier StevensFreeware
Registry Binary ParserGUIWindowswoanwareFreeware/Opensource
RegRipperRunnerGUIWindowswoanwareFreeware/Opensource
ForensicUserInfoGUIWindowswoanwareFreeware/Opensource
USBDeviceForensicsGUIWindowswoanwareFreeware/Opensource
Windows USB Storage Parser (usp)CLIWindowsTZWorksFreeware/Commercial
Yet Another Registry Utility (yaru)CLIWindowsTZWorksFreeware/Commercial
Windows ShellBag Parser (sbag)CLIWindowsTZWorksFreeware/Commercial
Computer Account Forensic Artifact Extractor (cafae)CLIWindowsTZWorksFreeware/Commercial



파일시스템 메타데이터 (Filesystem Metadata)

NameInterfacePlatformManufacturerLicence
mft2csvGUIWindowsjoakimFreeware
anlyzeMFTCLIAnywhereDavid KovarOpensource
MFTViewGUIWindowsSanderson ForensicsFreeware
NTFS Directory EnumeratorCLIWindowsTZWorksFreeware/Commercial
Windows $MFT and NTFS Metadata Extractor ToolCLIWindowsTZWorksFreeware/Commercial
Windows INDX Slack ParserCLIWindowsTZWorksFreeware/Commercial
Graphical Engine for NTFS Analysis (gena)CLIWindowsTZWorksFreeware/Commercial



바로가기 파일 분석 (LNK Analysis)

NameInterfacePlatformManufacturerLicence
Windows LNK Parsing Utility (lp)CLIWindowsTZWorksFreeware/Commercial
lnkanalyserCLIWindowsWoanwareFreeware



로그 분석 (Log Analysis)

NameInterfacePlatformManufacturerLicence
Event Log ExplorerGUIWindowsFSPro LabsCommercial
Log ParserCLIWindowsMicrosoftFreeware
NTFS Log TrackerGUIWindowsblueangelFreeware
NTFS TriForceCLIWindowsDavid CowenFreeware
Windows Journal Parser (jp)GUIWindowsTZWorksFreeware/Commercial
Windows Event Log ViewerGUIWindowsTZWorksFreeware/Commercial
Windows Event Log ParserGUIWindowsTZWorksFreeware/Commercial
UsnJrnl2CsvCLIWindowsjoakimFreeware
LogFile ParserCLIWindowsjoakimFreeware



악성코드 분석 (Malware Analysis)

NameInterfacePlatformManufacturerLicence
PeStudioGUIWindowsMarc OchsenmeierFreeware
PEViewGUIWindowsWayne J. RadburnFreeware
AutomaterCLIWin & LinTEKDEFENSEOpenSource
NoribenCLIWindowsRurikOpenSource



프리패치 분석 (Prefetch Analysis)

NameInterfacePlatformManufacturerLicence
WinPrefetchViewGUIWindowsNirSoftFreeware
PrefetchForensicsGUIWindowswoanwareFreeware
APFA(Advanced Prefetch File Analyzer)GUIWindowsAllan S HayFreeware
Prefetch ParserCLIWindowsSANSFreeware
Windows Prefetch ParserCLIAnywhereTZWorksFreeware/Commercial



웹 브라우저 사용 흔적 (Web Browser Artifacts)

NameInterfacePlatformManufacturerLicence
WEFA(WEb browser Forensic Analyzer)GUIWindows4&6 TechCommercial
Web HistorianGUIWindowsMandiantFreeware
IEF(Internet Evidence Finder)GUIWindowsMagnet ForensicsCommercial
ChromeForensicsGUIWindowswoanwareFreeware
FireFoxForensicsGUIWindowswoanwareFreeware
firefoxsessionstoreextractorGUIWindowswoanwareFreeware
Windows ‘index.dat’ Parser (id)CLIWindowsTZWorksFreeware/Commercial
BrowsingHistoryViewGUIWindowsNirSoftFreeware
IECacheViewGUIWindowsNirSoftFreeware
IECookiesViewGUIWindowsNirSoftFreeware
IEHistoryViewGUIWindowsNirSoftFreeware
ChromeCacheViewGUIWindowsNirSoftFreeware
ChromeHistoryViewGUIWindowsNirSoftFreeware
MozilaCacheViewGUIWindowsNirSoftFreeware
MozilaCookieViewGUIWindowsNirSoftFreeware
MozilaHistoryViewGUIWindowsNirSoftFreeware
SafariCacheViewGUIWindowsNirSoftFreeware
SafariHistoryViewGUIWindowsNirSoftFreeware
OperaCacheViewGUIWindowsNirSoftFreeware
WebBrowserPassViewGUIWindowsNirSoftFreeware
MyLastSearchGUIWindowsNirSoftFreeware



데이터베이스 분석 (Database Analysis)

NameInterfacePlatformManufacturerLicence
Exchange EDB ViewerGUIWindowsLepide SoftwareFreeware
ESEDatabaseViewGUIWindowsNirSoftFreeware
EseDbViewerGUIWindowswoanwareFreeware
SQLite ExpertGUIWindowsBogdan UrecheCommercial
Oxygen SQLite ViewerGUIWindowsOxygen ForensicCommercial
SQLite Database BrowserGUIWin & MacTabuleiroOpensource
OracleForensics Tools



이메일 분석 (Email Analysis)

NameInterfacePlatformManufacturerLicence
E-mail ExaminerGUIWindowsParabenCommercial
Mail ViewerGUIWindowsMiTeCFreeware
Email UtilitiesGUIWindowsStellar Information SystemsCommercial
Email Recovery ToolsGUIWindowsLepide SoftwareCommercial



포맷 분석 (Format Analysis)

NameInterfacePlatformManufacturerLicence
010Editor TemplatesGUIWindowsSweetScape SoftwareCommercial
FileInsightGUIWindowsMcAfeeFreeware
Structed Storage ViewerGUIWindowsMiTeCFreeware
OffVisGUIWindowsMicrosoftFreeware
Windows Portable Executable Viewer (pe_view)GUIWindowsTZWorksFreeware/Commercial
PDF ParserCLIAnywhereDidier StevensFreeware
peedpdfCLIAnywhereJose Miguel EsparzaFreeware
PDF Stream DumperGUIWindowsDavid ZimmerFreeware



복원지점/볼륨섀도복사본 분석 (Restore Point/VSC))

NameInterfacePlatformManufacturerLicence
RP Log TrackerGUIWindowsblueangelFreeware
libvshadowCLIWindowsJoachim MetzFreeware
ShadowExplorerGUIWindowsShadowExplorerFreeware
ShadowKitGUIWindowsDavid DymFreeware
VSC ToolsetGUIWindowsJason HaleFreeware
ReconnoitreGUIWindowsSanderson ForensicsCommercial



자바 IDX 분석 (Java IDX Analysis))

NameInterfacePlatformManufacturerLicence
RP Log TrackerCLIAnywhereBrian BaskinOpenSource
JavaidxCLIWindowsMark WoanOpenSource
IdxparserCLIWindowsHarlan CarveyOpenSource



추가적인 아티팩트 분석 (Any Other Artifacts)

NameInterfacePlatformManufacturerLicence
Windows File AnalyzerGUIWindowsMiTeCFreeware
Windows Jump List Parser (jmp)CLIWindowsTZWorksFreeware/Commercial
Portable Executable Scanner (pescan)CLIWindowsTZWorksFreeware/Commercial
autorunnerGUIWindowswoanwareFreeware
exefinderGUIWindowswoanwareFreeware
JumpListerGUIWindowswoanwareFreeware
shimcacheparserGUIWindowswoanwareFreeware
Windows Search Index ExtractorGUIWindowsFilesig SoftwareCommercial
Thumbnail Database ViewerGUIWindowsIgor TolmacheFreeware
SFP(Simple File Parser)GUIWindowsChris MayhewFreeware



네트워크 포렌식 (Network Forensics)

NameInterfacePlatformManufacturerLicence
WireSharkGUIAnywhereWireSharkFreeware
NetworkMinerGUIWindowsNETRESECCommercial
RSA NetWitnessGUIWin & LinRSACommercial
OstinatoGUIAnywherePstavirsOpensource
Packet BuilderGUIWindowsColasoftFreeware
SplitCapCLIWindowsNETRESECOpensource
tsharkCLIAnywhereWireSharkFreeware
ScapyCLIAnywherePhilippe BiondiOpensource
tcpdumpCLIAnywhereFreeware
DNS Query Utility (dqu)CLIWindowsTZWorksFreeware/Commercial
Packet Capture ICMP Carver (pic)CLIWindowsTZWorksFreeware/Commercial
Network Xfer Client/Server Utility (nx)CLIWindowsTZWorksFreeware/Commercial
snorbertCLIWindowsWoanwareFreeware
SessionViewerCLIWindowsWoanwareFreeware
enumdotnetCLIWindowsWoanwareFreeware



패스워드 공격(Password Attack)

NameInterfacePlatformManufacturerLicence
EPRB(ElcomSoft Password Recovery Bundle)GUIWindowsElcomSoftCommercial
PPR(Passware Password Recovery)GUIWindowsPasswareCommercial
SAMInsideGUIWindowsInsideProFreeware
ophcrackGUIAnywhereOBJECTIF SECURITEFreeware
L0PHTCRACKGUIWindowsL0pht HoldingsCommercial



윈도우 패스워드(Windows Password)

NameInterfacePlatformManufacturerLicence
Cain & AbelGUIWindowsMassimiliano MontoroFreeware
Windows Password RecoveryGUIWindowsPasscape SoftwareFreeware
pwdump7CLIWindowsTarascoFreeware
gsecdumpCLIWindowsTruesecFreeware
PWDumpXCLIWindowsReed ArvinFreeware
lsadump2CLIWindowsizarFreeware
creddumpCLIWindowsmooyixOpensource
NTPWEditGUIWindowsVadim DruzhinFreeware
NTPasswordCLIWindowsPogostickFreeware



모바일 포렌식 (Mobile Forensics)

NameInterfacePlatformManufacturerLicence
MD SeriesGMDSystemCommercial
Cellebrite Mobile ForensicsCellebriteCommercial
Device SeizureParabenCommercial
XRY SeriesMicro SystemationCommercial
Oxygen Forensic® SuiteGUIWindowsOxygen SoftwareCommercial
MPE+GUIWindowsAccess DataCommercial
LanternGUIMacKatanaForensicsCommercial
iPhone Backup BrowserGUIWindowsrene.devichiCommercial



헥스 편집기 (Hex Editor)

NameInterfacePlatformManufacturerLicence
010EditorGUIWindowsSweetScapeCommercial
WinHexGUIWindowsX-Ways Software Technology AGCommercial
HexWorkshopGUIWindowsHexWorkshopCommercial
HxDGUIWindowsMael HorzFreeware



해쉬 분석 (Hash Analysis)

NameInterfacePlatformManufacturerLicence
HashTabGUIWin & MacImplbitsFree/Comm
md5deep/hashdeepCLIAnywhereJesse KornblumFreeware
ssdeepCLIAnywhereManTechFreeware
NSRL HashsetsNISTFreeware



완전삭제 (Wipe/Sanitization)

NameInterfacePlatformManufacturerLicence
EraserGUIWindowsThe Eraser ProjectFreeware
BCWipeGUIWin & LinJeticoCommercial
SDeleteCLIWindowsSysinternalsFreeware
Secure EraseCLIWin & LinCMRRFreeware



데이터 복구 (Data Recovery)

NameInterfacePlatformManufacturerLicence
RMF(Recover My Files)GUIWindowsGetDataCommercial
R-StudioGUIAnywhereR-Tools TechnologyCommercial
Power Data RecoveryGUIWindowsMiniTool® SolutionCommercial



그 밖에… (Other Tools)

NameInterfacePlatformManufacturerLicence
HighlighterGUIWindowsMandiantFreeware
BinTextGUIWindowsMcAfeeFreeware
DCodeGUIWindowsDigital DetectiveFreeware
TimeLordGUIWindowsHarry ParsonageFreeware
ArgosDFASGUIWindowsDUZONCommercial



포렌식 도구 사이트 (dForensics Tool Sites)

Site
MiTeC
TZWorks
Software for Computer Forensics
Woanware
NirSoft
CFTT Catalog
mft2csv
Open Source Digital Foresncis
RCE Tool Libary
Sysinternals
ForensicKB

출처 : http://forensic-proof.com


'Memory Forensic' 카테고리의 다른 글

포렌식 툴 모음  (0) 2018.09.08
파일 시그니처 모음  (0) 2018.09.08
디지털 포렌식 입문을 위한 툴  (0) 2018.09.08
메모리 포렌식 개념  (0) 2018.09.07
 Header Signature (Hex) File Type Description
 xx xx xx xx AF 11 FLI Graphics – Autodesk Animator
 xx xx xx xx AF 12 FLC Graphics – Autodesk 3D Studio
 xx xx 2D 6C 68 35 2D

–   1   h   5  –

 LZH Archive – LHA Compressed Archive File
 00 PIF

PIC

YTR

 Windows – Program Information File

Graphics – IBM Storyboard Bitmap File

IRIS OCR Data File

 00 00 00 02 MAC Graphics – MAC Picture Format
 00 00 00 nn 66 74 79 70

f   t   y   p

33 67 70

3  g  p

 3GG

3G2

 3rd Generation Partnership Project 3GPP (nn=0x14)

3GPP2 (nn=0x20) Multimedia File

 00 00 00 18 66 74 79 70

f   t   y   p

33 67 70 35

  3  g  p   5

 MP4

 

 MPEG-4 Video File

 

 00 00 01 00 ICO Graphics – Windows Icon Format
 00 00 01 Bx MPG MPEG Video File
 00 00 02 00 CUR

WB2

 Graphics – Windows Cursor File

Spreadsheet  – QuattroPro

 00 00 02 00 04 04 WKS Spreadsheet – Lotus 1-2-3
 00 00 02 00 05 04 WRK Spreadsheet – Symphony
 00 00 02 00 06 04 WK1

WR1

 Spreadsheet – Lotus 1-2-3

Spreadsheet – Symphony

 00 00 1A 00 00 10 WK3 Spreadsheet – Lotus 1-2-3
 00 00 1A 00 02 10 WK4 Spreadsheet – Lotus 1-2-3
 00 00 49 49 58 50 52

I   I   X  P  R 

 QXD Quark Express Document (dependant endian)

Note: It appears that the byte following the 0x52

(“R”) is the languate indicator; 0x33(“3”) seems to

indicate English and 0x61(“a”) reportedly indicates

Korean

 00 00 49 49 58 50 52

M  M  X  P  R 

 QXD Quark Express Document (dependant endian)

Note: It appears that the byte following the 0x52

(“R”) is the languate indicator; 0x33(“3”) seems to

indicate English and 0x61(“a”) reportedly indicates

Korean

 00 00 EF FF Byte-order mark for 32-bit Unicode Transformation

Format

 00 01 00 00 4D 53 49 53

M  S   I  S

41 4D 20 44  61 74 61 74

A  M      D   a   t   a   b

61 62 61 73 65

a  s  e

 MNY

 

 Microsoft Money File

 

 00 01 00 00 53 74 61 72

S   t   a  n

64 61 72 64 20 4A 65 74

d  a   r   d     J   e   t

20 44 42

D  B

 MDB

 

 Database – Microsoft Access File

 

 00 01 00 08 IMG Graphics – GEM Image Format
 00 01 01 FLT Graphics – OpenFlight 3D File
 00 01 42 41

B  A

 ABA Palm Address Book Archive File
 00 01 42 44

B  D

 DBA Palm DataBook Archive File
 00 06 15 61 00 00 00 02

00 00 04 D2 00 00 10 00

 DB Database – Netscape Navigator (v4)
 01 11 AF FLI Graphics – FLIC Animation File
 00 1E 84 90 00 00 00 00 SNM Netscape Communicator (v4) Mail Folder
 00 5C 41 B1 FF ENC Mujahideen Secrets 2 Encrypted File
 00 6E 1E F0                    (offset : 512 bytes) PPT PowerPoint Presentation SubHeader
 01 00 00 00

 

 EMF
PIC
 Extended(Enhanced) Windows Metafile Format

Printer Spool File (0x18-17 & 0xC4-36 : Win2K/NT,

0x5C0-1 : WinXP)

Spreadsheet Graph – Lotus 1-2-3

 01 10 TR1 Novell LANalyzer Capture File
 01 DA 01 01 00 03 RGB Graphics – Silicon Graphics RGB Bitmap File
 01 FF 02 04 03 02 DRW Graphics – Micrografx Vector Graphics File
 02 64 73 73

d   s  s

 DSS Graphics – Digital Speech Standard

(Olympus, Grundig & Phillips)

 02 DBF Database – dBASE II
 03 DBF

DAT

 Database – dBASE III

Database – dBASE IV

MapInfo Native Data Format

 03 00 00 00 QPH Quicken Price Histroy File
 03 00 00 00 41 50 50 52

A  P  P  R

 ADX Approach Index File
 04 DB4 Database – dBASE IV Data File
 07 DRW A common signature may drawing programs
 07 64 74 32 64 64 74 64

d   t   2  d  d   t   d

 DTD DesignTools 2D Design File
 08 DB Database – dBASE IV

Database – dBFast Configuration File

 09 00 04 00 07 00 01 00 XLW Spreadsheet – Excel BIFF2
 09 02 06 00 00 00 01 00 XLW Spreadsheet – Excel BIFF3
 09 03 06 00 00 04 00 01 XLW Spreadsheet – Excel BIFF4
 0A nn 01 01 PCX Graphics – ZSOFT Paintbrush

(nn = 0x02, 0x03, 0x05)

 0C ED MP Graphics – Monochrome Picture TIFF Bitmap File
 0D 44 4F 43

D  O  C

 DOC DeskMate Document File
 0E 57 4B 53

W  K  S

 WKS DeskMate Worksheet
 0F 00 E8 03                     (offset : 512 bytes) PPT PowerPoint Presentation SubHeader (MS Office)
 11 00 00 00 53 43 43 41

S  C  C  A

 PF Windows Prefetch File
 1A 00 00 NTF Database – Lotus Notes Template File
 1A 00 00 04 00 00 NSF Database – Lotus Notes File
 1A 0x ARC Archive – LH Achive File, Old Version

(x = 0x02, 0x03, 0x04, 0x08, 0x09)

 1A 0B PAK Archive – PAK Archive File
 1A 35 01 00

5

 ETH GN Nettest WinPharoah Capture File
 1A 52 54 53 20 43 4F 4D

R  T  S      C  O  M

50 52 45 53 53 45 44 20

P  R  E  S  S  E  D

49 4D 41 47 45 20 56 31

I   M  A  G  E     V   1

2E 30 1A

.   0

 DAT

 

 Graphics – Runtime Software Disk Image File

 

 1D 7D WS WordStar Version 5.0/6.0 Document File
 1F 8B 08 GZ Archive – GZIP Archive File
 1F 9D 90 TAR.Z Archive – Tape Archive File
 21 12

!

 AIN Archive – AIN Archive File
 21 3C 61 72 63 68 3E 0A

!   <  a   r   c  h  >

 LIB Archive – Unix Archiver(ar) Files

Microsoft Program Library Common Object File

Format (COFF)

 21 42 44 4E

!  B  D  N

 PST Microsoft Outlook File
 23 20

#

 MSI Cerius2 File
 23 20 4D 69 63 72 6F 73

#       M  i   c   r  o   s

6F 66 74 20 44 65 76 65

o  f    t      D   e   v  e

6C 6F 70 65 72 20 53 74

l   o   p   e  r      S  t

75 64 69 6F

u  d   i   o

 DSP

 

 Microsoft Developer Studio Project File

 

 23 21 41 4D 52

#   !   A  M  R

 AMR Adaptive Multi-Rate ACELP Codec Format
 24 46 4C 32 40 28 23 29

$   F  L   2  @  (  #   )

20 53 50 53 53 20 44 41

S  P  S  S      D  A

54 41 20 46 49 4C 45

T  A       F   I  L  E

 SAV

 

 SPSS Data File

 

 25 21 50 53 2D 41 64 6F

%  !   P  S  –   A  d  o

62 65 2D

b  e  –

 EPS

 

 Adobe Encapsulated PostScript File

 

 25 50 44 46

% P  D  F

 PDF

FDF

 Adobe Portable Document Format File

Forms Document File

 28 54 68 69 73 20 66 69

(  T  h   i   s      f    i

6C 65 20 6D 75 73 74 20

l    e     m  u  s  t

62 65 20 63 6F 6E 76 65

b  e       c  o  n   v   e

72 74 65 64 20 77 69 74

r   t   e   d      w  i   t

68 20 42 69 6E 48 65 78

h  B   i   n   H  e  x

20

 HQX Archive – Macintosh BinHex 4 Archive
 2A 2A 2A 20 20 49 6E 73

*   *   *           I   n   s

74 61 6C 6C 61 74 69 6F

t   a   l   l    a   t   i   o

6E 20 53 74 61 72 74 65

n     S   t   a   r   t   e

64 20

d

 LOG

 

 Symantec Wise Installer Log File

 

 2D 6C 68

–   l    h                           (offset : 2 bytes)

 LHA, LZH Archive – Compressed Archive File
 2E 52 45 43

R  E  C

 IVR RealPlayer Video File (v11 and later)
 2E 72 61 FD 00

r   a

 RA RealMedia Streaming Media File
 2E 52 4D 46

.   R  M  F

 RM Real Media File
 2E 73 6E 64

.   s   n  d

 AU Sound – NeXt/Sun Audio Format
 30

0

 CAT Microsoft Security Catalog File
 30 00 00 00 4C 66 4C 65

0              L   f   L   e

 EVT Windows Event Viewer File
 30 26 B2 75 8E 66 CF 11

A6 D9 00 AA 00 62 CE 6C

 ASF, WMA,

WMV

 Microsoft Windows Media Audio/Video File

(Advanced Streaming Format)

 30 31 4F 52 44 4E 41 4E

0  1   O  R  D  N  A  N

43 45 20 53 55 52 56 45

C  E      S  U  R  V  E

59 20 20 20 20 20 20 20

Y

 NTF

 

 National Transfer Format Map File

 

 31 BE 00 00 00 AB DOC Word processor – MS Word 4
 3n BE 00 00 00 AB WRI Word processor – MS Write (n = 0x1, 0x2)
 34 12 PIC Graphics – PC Paint
 37 7A BC AF 27 1C 7Z Archive – 7-Zip Archive File
 38 42 50 53

8  B  P  S

 PSD Graphics – Adobe Photoshop File
 3A DE 68 B1 DCX Graphics – CAS Fax Format
 3C ASX Advanced Stream Redirector File
 3C XDR BizTalk XML-Data Reduced Schema File
 3C 21 64 6F 63 74 79 70

<    !   d  o  c   t   y   p

 DCI AOL HTML Mail File
 3C 3F 78 6D 6C 20 76 65

<   ?   x  m   l        v  e

72 73 69 6F 6E 3D

r   s  i   o   n  =

 MANIFEST

 

 Windows Visual Stylesheet XML File

 

 3C 3F 78 6D 6C 20 76 65

<   ?   x  m   l        v  e

72 73 69 6F 6E 3D 22 31

r   s  i   o   n  =   ”   1

2E 30 22 3F 3E

.   0   ”   ?   >

 XUL

 

 XML User Interface Language File

 

 3C 3F 78 6D 6C 20 76 65

<   ?   x  m   l        v  e

72 73 69 6F 6E 3D 22 31

r   s  i   o   n  =   ”   1

2E 30 22 3F 3E 0D 0A 3C

.   0   ”   ?   >           <

4D 4D 43 5F 43 6F 6E 73

M  M  C  _  C   o  n   s

6F 6C 65 46 69 6C 65 20

o   l   e  F   i   l   e

43 6F 6E 73 6F 6C 65 56

C   o  n   s  o   l   e   V

65 72 73 69 6F 6E 3D 22

e  r   s  i   o   n   =   “

 MSC

 

 Microsoft Management Console Snap-in Control

File

 3E 00 03 00 FE FF 09 00

06                                  (offset : 24 bytes)

 WB3 Quatro Pro for Windows 7.0 Notebook File
 3F 5F 03 00

?  _

 GID Windows Help Index File
 3F 5F 03 00

?  _

 HLP Windows Help File
 41 48

A  H

 PAL, PIC Graphics – Dr Halo Format
 41 4C 5A 01

A  L   Z

 ALZ Archive – ESTsoft Alzip Archive File
 40 40 40 20 00 00 40 40

@ @ @             @ @

40 40

@ @

 ENL

 

 EndNote Library File

 

 41 43 53 44

A  C  S  D

 Miscellaneous AOL Parameter and Information

File

 41 4D 59 4F

A  M  Y  O

 SYW Graphics – Hardvard Graphics Symbol Graphic
 41 4F 4C 20 46 65 65 64

A  O  L       F   e   e  d

62 61 67

b  a  g

 BAG

 

 AOL and AIM Buddy List File

 

 41 4F 4C 44 42

A  O   L  D  B

 ABY, IDX Database – AOL Database File (ABY, MAIN.IDX)
 41 4F 4C 49 44 58

A  O  L    I   D  X

 IND AOL Client Preferences/Settings File (MAIN.IND)
 41 4F 4C 49 4E 44 45 58

A  O  L    I   N  D  E  X

 ABI AOL Address Book Index File
 41 56 47 36 5F 49 6E 74

A  V  G   6  _   I   n   t

65 67 72 69 74 79 5F 44

e  g  r   i    t   y  _  D

61 74 61 62 61 73 65

a  t   a   b  a  s  e

 DAT

 

 AVG6 Integrity Database File

 

 41 56 49 20 4C 49 53 54

A  V   I       L   I   S  T

 Audio/Video Interleaved File
 41 4F 4C 56 4D 31 30 30

A  O  L   V  M   1  0  0

 AOL Personal File Cabinet (PFC) File
 41 72 43 01

A   r   C

 ARC Archive – FreeArc Archive File
 42 45 47 49 4E 3A 56 43

B  E  G   I   N  :   V  C

41 52 44 0D 0A

A  R  D

 VCF

 

 vCard File

 

 42 4C 49 32 32 33 51

B   L   I   2   2  3  Q

 BIN Tomson Speedtouch Series WLAN Router

Firmware File

 42 4D

B  M

 BMP, DIB Graphics – Windows Bitmap Format
 42 4F 4F 4B 4D 4F 42 49

B  O  O  K  M  O  B   I

 PRC Palmpilot Resource File
 42 5A 68

B  Z   h

 BZ2, TAR,

TBZ2, TB2

 Archive – bzip2 Archive File
 43 42 46 49 4C 45

C  B  F   I   L  E

 CBD WordPerfect Dictionary File
 43 44 30 30 31

C  D   0   0  1

 ISO ISO-9660 CD Disc Image
 43 4F 4D 2B

C  O  M   +

 CLB COM+ Catalog File
 43 52 45 47

C  R  E  G

 DAT Windows 9x Registry Files
 43 52 55 53 48 20 76

C  R  U  S  H      v

 CRU Archive – Crush Archive File
 43 54 4D 46

C  T  M  F

 CMF Sound – Creative Music Format
 43 57 53

C  W  S

 SWF Shockwave Flash File (v5+)
 43 61 74 61 6C 6F 67 20

C  a   t   a   l   o   g

33 2E 30 30 00

3   .   0   0

 CTF

 

 Wherelslt Catalog File

 

 43 6C 69 65 6E 74 20 55

C   l    i   e   n   t      U

72 6C 43 61 63 68 65 20

r   l   C   a  c   h  e

4D 4D 46 20 56 65 72 20

M  M  F      V   e  r

 DAT

 

 IE History DAT File

 

 43 72 65 61 74 69 76 65

C  r   e  a   t   i   v   e

20 56 6F 69 63 65 20 46

V  o   i   c   e      F

69 6C 65 1A

i   l    e

 VOC

 

 Sound – Creative Voice Format

 

 44 42 46 48

D  B  F  H

 DB Palm Zire Photo Database
 44 4D 53 21

D  M  S  !

 DMS Archive – Amiga DiskMasher Archive File
 44 4F 53

D  O  S

 ADF Amiga Disk File
 44 61 6E 4D

D  a   n  M

 MSP Graphics – Windows Paint
 45 4E 54 52 59 56 43 44

E  N  T  R  Y  V  C  D

02 00 00 01 02 00 18 58

X

 VCD

 

 Video VCD (GNU VCDImager) File

 

 45 54 46 53 53 41 56 45

E  R  F  S  S  A  V  E

44 41 54 41 46 49 4C 45

D  A  T  A  F   I   L  E

 DAT

 

 Kroll EasyRecovery Saved Recovery State File

 

 45 56 46

E  V  F

 Enn

(nn = number)

 EnCase Evidence File
 45 59 45 53

E  Y  E  S

 CE1, CE2 Graphics – ComputerEyes Format
 46 4F 52 4D

F  O  R  M

 LBM Graphics – Interchange File Format
 46 41 58 43 4F 56

F  A  X  C  O  V

45 52 2D 56 45 52

E  R   –  V  E  R

 CPE

 

 Microsoft Fax Cover Sheet

 

 46 45 44 46

F  E  D  F

 SBV Unkown File Type
 46 4C 56 SWF Flash Video File
 46 4F 52 4D 00 AIFF Audio – Audio Interchange File
 46 57 53

F  W  S

 SWF Shockwave Flash File
 46 72 6F 6D 20 20 20

F  H  o  m                      or

46 72 6F 6D 20 3F 3F 3F

F  H  o  m      ?   ?   ?     or

46 72 6F 6D 3A 20

F  H  o  m   :

 EML

 

 A common File Extension for E-mail File

 

 47 46 31 50 41 54 43 48

G  F   1  P  A  T  C  H

 PAT Advanced Gravis Ultrasound Patch File
 47 49 46 38 37 61

G  I   F   8   7  a

 GIF Graphics – Graphics Interchange Format
 47 49 46 38 39 61

G  I   F   8   9  a

 GIF Graphics – Graphics Interchange Format
 47 50 41 54

G  P  A  T

 PAT GIMP (GNU Image Manipulation Program) Pattern

File

 47 58 32

G  X  2

 GX2 Graphics – Show Partner Graphics File
 48 48 47 42 31

H  H  G  B  1

 SH3 Harvard Graphics Presentation File
 49 49 2A

I   I   *

 TIF, TIFF Graphics – Tagged Image File Format File

(Little Endian)

 4D 4D 2A

M  M   *

 TIF, TIFF Graphics – Tag Image File Format

(Big Endian)

 49 42 4B 1A

I  B  K

 IBK Sound – Soundblaster Instrument Bank
 49 44 33

I   D  3

 MP3 Sound – MPEG-1 Audio Layer 3 (MP3) Audio File
 49 4D 44 43

I  M  D  C

 IC1, IC2, IC3 Graphics – Atari Imagic Film Format
 49 53 63 28

I   S  c  (

 CAB Archive – Install Shield (v5+) Archive File
 49 54 53 46

I  T  S  F

 CHM Microsoft HTML Help Compiled File
 49 6E 6E 6F 20 53 65 74

I   n   n   o      S  e  t

75 70 20 55 6E 69 6E 73

u   p     U  n   i   n  s

74 61 6C 6C 20 4C 6F 67

t   a   l   l        L   o   g

20 28 62 29

(  b   )

 DAT

 

 Inno Setup Uninstall Log File

 

 4A 41 52 43 53 00

J  A  R  C  S

 JAR Archive – JARCS Archive File
 4A 47 0n 0E 00 00 00 ART AOL ART File (n = 0x3, 0x4)
 4C 00 00 00

L

 LNK Microsoft Windows Shortcut File
 4C 01

L

 OBJ Microsoft Common Object File Format (COFF)

Relocatable Object Code File

 4C 4E 02 00

L  N

 HLP Windows Help File
 4C 69 6E 53

L   i   n  S

 MSP Graphics – Windows 3.x Paint
 4D 47 43

M  G  C

 CRD Database – Windows 3.x Card File
 4D 49 4C 45 53

M   I  L   E  S

 MLS Mailestones v1.0 Project Management and

Scheduling Software (Also see “MV2C”, “MV214”)

 4D 4C 53 57

M  L   S  W

 MLS Skype Localization Data File
 4D 4D 00 2A

M  M      *

 TIF, TIFF Graphics –  Big Tagged Image File Format (TIFF)

(big endian)

 4D 4D 00 2B

M  M      +

 TIF, TIFF Graphics –  Big Tagged Image File Format (TIFF)

File ( > 4GB)

 4D 4D 4D 44 00 00

M  M  M  D

 MMF Yamaha Cynthetic Music Mobile Application

Format (SMAF)

 4D 53 43 46

M  S  C  F

 CAB

PPZ

SNP

 Microsoft Cabinet File

Powerpoint Presentation Package

Microsoft Access Snapshot Viewer File

 4D 53 46 54 02 00 01 00

M  S  F  T

 TLB OLE, SPSS, Visual C++ Type Library File
 4D 53 5F 56 4F 49 43 45

M  S  _   V  O   I  C  E

 CDR, DVF,

MSV

 Sound – Sony Compressed Voice File

Sound – Sony Memory Stick Compressed Voice

File

 4D 54 68 64

M  T   h  d

 MID, MIDI Sound – Standard Musical Instrument Digital

Interface (MIDI) Format

 4D 56

M  V

 DSN CD Stomper Pro Label File
 4D 56 32 31 34

M  V   2   1  4

 MLS Milestones v2.1b Project Management and

Scheduling Software (Also see “MILES”, “MV2C”)

 4D 56 32 43

M  V   2  C

 MLS Milestones v2.1a Project Management and

Scheduling Software (Also see “MILES”, “MV214”)

 4D 5A

M  Z

 COM, DLL, DRV

EXE, PIF, QTS

QTX, SYS

ACM,

AX,

CPL,

FON,

OCX,

OLB,

SCR,

VBX,

VXD

 Windows/DOS Executable File
MS Audio Compression Manage Driver

Library Cache File

Control Panel Application

Font File

ActiveX or OLE Custom Control

OLE Object Library

Screen Saver

Visual Basic Application

Windows Virtual Device Drivers

 4D 5A 90 00 03 00 00 00

M  Z

 API,

AX,

FLT

 Acrobat Plug-in

DirectShow Filter

Adobe Audition Graphic Filter File

 4D 5A 90 00 03 00 00 00

M  Z

04 00 00 00 FF FF

 ZAP ZoneAlam Data File
 4D 69 63 72 6F 73 6F 66

M   i   c  r   o   s  o   f

74 20 56 69 73 75 61 6C

t       V  i   s  u   a  l

20 53 74 75 64 69 6F 20

S   t   u   d  i   o

53 6F 6C 75 74 69 6F 6E

S   o  l   u   t   i   o   n

20 46 69 6C 65

F   i   l   e

 SLN

 

 Visual Studio .NET Solution File

 

 4D 69 63 72 6F 73 6F 66

M   i   c  r   o   s  o   f

74 20 57 69 6E 64 6F 77

t      W  i   n   d  o  w

73 20 4D 65 64 69 61 20

s      M  e  d   i  a

50 6C 61 79 65 72 20 2D

P   l   a   y  e  r       –

2D 20

–                                    (offset : 84 bytes)

 WPL

 

 Windows Media Player Playlist

 

 4E 41 56 54 52 41 46 46

N  A  V  T   R  A  F  F

49 43

I  C

 DAT

 

 TomTom Traffice Data File

 

 4E 45 53 4D 1A 01

N  E  S  M

 NFS Sound – NES Sound File
 4E 49 54 46 30

N   I  T  F   0

 NTF National Imagery Transmission Format (NIFF) File
 4E 61 6D 65 3A 20

N  a  m  e   :

 COD Agent NewsReader Character Map File
 4F 50 4C 44 61 74 61 62

O  P  L  D  a   t   a   b

61 73 65 46 69 6C 65

a  s  e  F   i   l   e

 DBF

 

 Psion Series 3 Database File

 

 4F 67 67 53 00 02 00 00

O  g  g  s

00 00 00 00 00 00

 OGA, OGG,

OGV, OGX

 Ogg Vorbis Codec Compressed Multimedia File
 4F 7B

O  {

 DW4 Visio/DisplayWrite 4 Test File
 50 00 00 00 20 00 00 00

P

 IDX Quicken QuickFinder Information File
 50 35 0A

P  5

 PGM Graphics – Portable Graymap Graphic
 50 41 43 4B

P  A  C  K

 PAK Archive – Quake Archive File
 50 45 53 54

P  E  S  T

 DAT PestPatrol Data/Scan Strings
 50 49 43 54 00 08

P  I  C  T

 IMG Graphics –  ADEX ChromaGraph Graphics Card

Bitmap Graphics File

 50 4B 03 04

P  K 

 ZIP,

DOCX, PPTX,

XLSX,

JAR,

SXC, SXD, SXI,

SXW

WMZ,

XPI,

XPT

 Archive – Pkzip Archive File

Microsoft Office Open XML Format Document Java Archive Package

OpenOffice Spreadsheet, Drawing, Presentation

Windows Media Compressed Skin File

Mozila Browser Archive

eXact Packager Models

 50 4B 03 04 14 00 06 00

P  K

 DOCX, PPTX,

XLSX

 Microsoft Office Open XML Format Document
 50 4B 03 04 14 00 08 00

P  K

 JAR Java Archive
 50 4B 4C 49 54 45

P  K  L   I  T  E               (offset : 30 bytes)

 ZIP Archive – PKLITE ZIP Archive (see also PKZIP)
 50 4B 53 70 58

P  K  S  F  X                   (offset : 526 bytes)

 ZIP Archive – PKSFX Self-Extracting Executable Compressed File (see also PKZIP)
 50 4D 43 43

P  M  C  C

 GRP Windows Program Manager Group File
 50 4E 43 49 55 4E 44 4F

P  N  C   I  U  N  D

 DAT Noton Disk Doctor Undo File
 50 C3 CLP Windows 3.x Clipboard
 51 45 4C 20

Q  E  L  (offset : 92 bytes)

 QEL Quicken Data File
 51 46 49 FB

Q  F  I

 IMG QEMU Qcow Disk Image
 51 57 20 56 65 72 2E 20

Q  W      V   e  r

 ABD, QSD Quicken Data File
 52 41 5A 41 54 44 42 31

R  A  Z  A  T  D  B  1

 DAT Shareaza (Windows P2P Client) Thumbnail
 52 45 47 45 44 49 54

R  E  G  E  D  I  T

 REG, SUD Windows NT Registry and Registry Undo Files
 52 45 56 4E 55 4D 3A 2C

R  E  V  N  U  M   :   ,

 ADF Antenna Data File
 52 49  46  46

R   I   F   F

 ANI

DAT

DS4

 Windows Animated Cursof

Video CD MPEG or MPEG1 Movie File

Micrografx Designer v4 Graphic File

 52 49 46 46 xx xx xx xx

R  I  F  F

41 56 49 20 4C 49 53 54

A  V   I       L   I  S  T

 AVI

 

 Resource Interchange File Format –

Windows Audio Video Interleave File

 52 49 46 46 xx xx xx xx

R   I   F  F

43 44 44 41 66 6D 74 20

C  D  D  A   f   m  t

 CDA

 

 Resource Interchange File Format –

Compact Disc Digital Audio (CD-DA) File

 52 49 46 46 xx xx xx xx

R   I   F  F

51 4C 43 4D 66 6D 74 20

Q  L  C  M  f  m  t

 QCP Resource Interchange File Format –

Qualcomm PureVoice

 52 49 46 46 xx xx xx xx

R   I   F  F

52 4D 49 44 64 61 74 61

R  M   I  D   d  a   t   a

 RMI

 

 Resource Interchange File Format –

Windows Musical Instrument Digital Interface File

 52 49 46 46 xx xx xx xx

R   I   F  F

57 41 56 45 66 6D 74 20

W  A  V  E  f  m  t

 WAV

 

 Resource Interchange File Format –

Audio for Windows File

 52 54 53 53

R  T  S  S

 CAP Windows NT Netmon Capture File
 52 61 72 21 1A 07 00

R  a  r  !

 RAR Archive – WinRAR Compressed Archive File
 53 42 49 1A

S  B   I

 SBI Soundblaster Instrument Format
 53 43 48 6C

S  C  H  l

 AST Audio – Need for Speed : Undergraound Audio File
 53 43 4D 49

S  C  M  I

 IMG Img Software Set Bitmap File
 53 48 4F 57

S  H  O  W

 SHW Harvard Graphics DOC v2/x Presentation File
 53 49 45 54 52 4F 4F 49

S  I  E  T  R  O  N  I

43 53 20 58 52 44 20 53

C  S      X  R  D      S

43 41 4E

C  A  N

 CPI

 

 Sietronics CPI XRD Document File

 

 53 49 54 21 00

S   I   T  !

 SIT Archive – Stufflt Compressed Archive File
 53 4D 41 52 54 44 52 57

S  M  A  R  T  D  R  W

 SDR SmartDraw Drawing File
 53 51 4C 4F 43 4F 4E 56

S  Q  L  O  C  O  N  V

48 44 00 00 31 2E 30 00

H  D           1   .   0

 CNV

 

 DB2 Conversion File

 

 53 6D 62 6C

S  m  b  l

 SYM Harvard Graphics v2.x Graphics Symbol

Windows SDK Graphics Symbol

 53 74 75 66 66 49 74 20

S   t   u   f   f   I   t

28 63 29 31 39 39 37 2D

(  c  )   1   9   9   7   –

 SIT

 

 Archive – Stufflt Compressed Archive File

 

 54 43 53 4F 00 04 00 00 00 00

T  C  S  O                          (offset : 6 bytes)

 SOL Local Shared Object(LSO) File
 54 68 69 73 20 69 73 20

T   h   i   s      i   s

 INFO UNIX GNU Info Reader File
 55 43 45 58

U  C  E  X

 UCE Unicode Extensions
 55 46 41 C6 D2 C1

U  F  A

 UFA Archive – UFA Compressed Archive File
 55 46 4F 4F 72 62 69 74

U  F  O  O   r   b   i   t

 DAT UFO Capture v2 Map File
 56 43 50 43 48 30

V  C  P  C  H  0

 PCH Visual C PreCompiled Header File
 56 44 56 49

V  D  V   I

 AVS Intel Digital Video Interface
 56 45 52 53 49 4F 4E 20

V  E  R  S   I   O  N

 CTL Visual Basic User-Defined Control File
 57 4D 4D 50

W  M  M  P

 DAT Walkman MP3 Container File
 57 53 32 30 30 30

W  S  2   0   0   0

 WS2 WordStar for Windows v2 Document File
 57 69 6E 5A 69 70

W  i  n  Z  i  p             (offset : 29, 152 bytes)

 ZIP Archive – WinZip Compressed Archive File
 58 43 50 00

X  C  P

 CAP Cinco NetXRay, Network General Sniffer, and

Network Associates Sniffer Capture File

 58 50 43 4F 4D 0A 54 79

X  P  C  O  M      T  y

70 65 4C 69 62

p  e  L  i  b

 XPT

 

 XPCOM Type Libraries for The XPIDL Compiler

 

 58 54

X  T

 BDR MS Publisher Border
 59 A6 6A 95 RAS SUN Raster Format
 5A 4F 4F 20

Z  O  O

 ZOO Archive – ZOO Compressed Archive File
 5B 47 65 6E 65 72 61 6C

[  G   e   n   e   r   a   l

5D 0D 0A 44 69 73 70 6C

]           D   i   s   p   l

61 79 20 4E 61 6D 65 3D

a   y     N  a  m   e  =

3C 44 69 73 70 6C 61 79

<  D   i   s  p   l   a   y

4E 61 6D 65

N  a  m  e

 ECF

 

 Microsoft Exchange 2007 Extended Configuration

File

 5B 4D 53 56 43

[  M  S  V  C

 VCW Microsoft Visual C++ Workbench Information File
 5B 50 68 6F 6E 65 5D

[  P   h   o   n   e  ]

 DUN Dial-Up Networking File
 5B 56 45 52 5D 0D 0A 09

[  V  E  R  ]

 SAM AMU Pro Document
 5B 76 65 72 0D 0A 09

[  v  e  r  ]

 SAM AMU Pro Document
 5B 56 65 72 73 69 6F 6E

[  V  e   r   s   i   o  n  ]    (offset : 2 bytes)

 CIF Unknown File Type
 5B 57 69 6E 64 6F 77 73

[  W   i   n   d   o  w   s

20 4C 61 74 69 6E 20

L   a   t   i   n

 CPX

 

 Microsoft Code Page Translation File

 

 5B 66 6C 74 73 69 6D 2E

[   f    l   t   s   i   m

30 5D

0   ]

 CFG

 

 Flight Simulator Aircraft Configuration File

 

 5F 43 41 53 45 5F

_  C  A  S  E  _

 CAS, CBK EnCase v3 Case File

EnCase v4, 5, 6 use OLE 2 Container File

 60 EA ARJ Archive – ARJ Compressed Archive File
 62 65 67 69 6E

b  e  g  i  n

 UUencoded File
 63 75 73 68 00 00 00 02

c  u  s  h

00 00 00

 CSH Photoshop Custom Shape
 64 00 00 00

d

 P10 Intel PROset/Wireless Profile
 64 73 77 66 69 6C 65

d  s  w  f   i   l   e

 DSW Microsoft Visual Studio Workspace File
 66 4C 61 43 00 00 00 22

f   L  a  C              “

 FLAC Free Lossless Audio Codec File
 6C 33 33 6C

l   3   3   l

 DBB Skype User Data File
 6D 6F 6F 76

m  o   o   v      or             (offset : 4 bytes)

66 72 65 65

f   r   e   e       or              (offset : 4 bytes)

6D 64 61 74

m  d   a   t      or              (offset : 4 bytes)

77 69 64 65

w  i   d   e      or               (offset : 4 bytes)

 MOV

 

 Apple QuickTime Movie File

 

 72 65 67 66

r   e  g   f

 DAT Windows Registry Hive File
 72 74 73 70 3A 2F 2F

r   t   s   p   :   /   /

 RAM RealMedia Metafile
 73 6C 68 21

s   l   h   !    or

73 6C 68 2E

s   l   h   .

 DAT

 

 Allegro Generic Packfile Data File

(0x21 = Compressed,  0x2E = Uncompressed )

 73 72 63 64 6F 63 69 64

s   r   c   d  o  c  i   d

3A

:

 CAL

 

 Graphics – CALS Raster Bitmap File

 

 73 7A 65 7A

s   z   e   z

 PDB PowerBASIC Debugger Symbols File
 74 42 4D 50 4B 6E 57 72

t   B  M  P  K  n   W  r       (offset : 60 bytes)

 PRC PathWay Map File (used GPS devices)
 75 73 74 61 72

u   s   t   a   r                   (offset : 257 bytes)

 TAR Archive – Tape Archive File
 76 32 30 30 33 2E 31 30

v   2   0   0   3   .  1  0

0D 0A 30 0D 0A

0

 FLT

 

 Qimage Filter

 

 78

x

 DMG Mac OS X Disk Copy Disk Image File
 7A 62 65 78

z   b   e   x

 INFO ZoomBowser Image Index File (ZbThumbnal.info)
 7B 0D 0A 6F 20

{            o

 LGC, LGD Windows Application Log File
 7B DBF Database – dBASE IV
 7B 5C 72 74 66 31

{     r   t   f   1

 RTF Word processor – Rich Text Format
 7E 42 4B 00

~  B  K

 PSP Graphics – Corel Paint Shop Pro Image File
 7F 45 4C 46

E  L  F

 Linux/Unix – Executable and Linking Format
 80 OBJ Relocatable Object Code
 80 00 00 20 03 12 04 ADX Dreamcase Audio File
 81 CD AB WPF Word processor – WordPerfect Test File
 83 DBF Database – dBASE III
 83 DBF Database – dBASE IV
 83 DBF Database –  FoxPro
 8B DBF Database – FoxPro
 89 50 4E 47 0D 0A 1A 0A

P  N  G

 PNG Graphics – Portable Network Graphics File
 8A 01 09 00 00 00 E1 08

00 00 99 19

 AW MS Answer Wizard File
 91 33 48 46 HAP Archive – Hamarsoft HAP 3.x Compressed Archive
 95 01 SKR PGP Secret Key Ring
 99 00 PKR PGP Public Key Ring
 99 01 PKR PGP Public Key Ring
 9B A5 DOC Word processor – Winword 1.0
 9C CB CB 8D 13 75 D2 11

91 58 00 C0 4F 79 56 A4

 WAB Outlook Address File
 A0 46 1D F0                     (offset : 512 bytes) PPT PowerPoint Presentation SubHeader
 A1 B2 C3 D4 tcpdump (libpcap) Capture File
 A1 B2 CD 34 Extended tcpdump (libpcap) Capture File
 A9 0D 00 00 00 00 00 00 DAT Access Data FTK Evidence File
 AC 9E BD 8F 00 00 QDF Quicken Data File
 B1 68 DE 3A DCX Graphics Multipage PCX Bitmap File
 B5 A2 B0 B3 B3 B0 A2 B5 CAL Windows 3.x Calendar
 BA BE EB EA ANI NEOchrome Animation File
 BE 00 00 00 AB 00 00 00

00 00 00 00 00

 WRI Microsoft Wirte File
 C3 AB CD AB ACS Microsoft Agent Character File
 C5 D0 D3 C6 EPS Adobe Encapsulated PostScript File
 C8 00 79 00 LBK Jeppesen FiteLog File
 CA FE BA BE CLASS Java Bytecode File
 CD 20 AA AA 02 00 00 00 Norton Anti-Virus Quarantined Virus File
 CF 11 E0 A1 B1 1A E1 00 DOC Word processor – Perfect Office Document File
 CF AD 12 FE DBX Microsoft Outlook Express E-mail File
 D0 CF 11 E0 A1 B1 1A E1 HWP

DOC, DOT, PPS

PPT, XLA, XLS

WIZ

AC_

ADP

APR

DB

MSC

MSI

MTW

OPT

PUB

SOU

SPO

VSD

WPS

 HAANSOFT Compound Document File

Microsoft Office Compound Document File
CaseWare Working Papers Compressed Client File

Access Project File

Lotus/IBM Approach 97 File

MSWorks Database File

Microsoft Common Console Documet File

Microsoft Installer Package

Minitab Data File

Developer Studio File Workspace Options File

Microsoft Publisher File

Visual Studio Solution User Options File

SPSS Output File

Visio File

MSWorks Text Document File

 D2 0A 00 00 FTR GN Nettest WinPharoah Filter File
 D4 2A ARL, AUT AOL History (ARL) and Typed URL (AUT) Files
 D4 C3 B2 A1 WinDump (Winpcap) Capture File
 D7 CD C6 9A WMF Graphics – Windows Metafile Format
 DB A5 DOC Word processor – Winword 2.0
 DC DC CPL Corel Color Palette File
 DC FE EFX eFax File Format
 E3 10 00 01 00 00 00 00 INFO Amiga Icon File
 E3 82 85 96 PWL Windows Password File
 E8  or

E9  or

EB  or

 COM, SYS Windows Executable File
 EB 3C 90 2A IMG GEM Raster File
 EC A5 C1 00                   (offset : 512 bytes) DOC Word Document SubHeader
 ED AB EE DB RPM RedHat Package Manager File
 EF BB BF Byte-order Mark for 8-bit Unicode Transformation

Format (UTF-8) File

 F5 DBF FoxPro Database
 FD FF FF FF 04                 (offset : 512 bytes) SUO Visual Studio Solution User Options SubHeader
 FD FF FF FF nn 00 00 00    (offset : 512 bytes) PPT PowerPoint Presentation SubHeader

(nn = 0x0E, 0x1C, 0x43)

 FD FF FF FF nn 00   or      (offset : 512 bytes)

FD FF FF FF nn 02            (offset : 512 bytes)

 XLS Excel Spreadsheet SubHeader

(nn = 0x10, 0x1F, 0x22, 0x23, 0x28, 0x29)

 FD FF FF FF 20 00 00 00    (offset : 512 bytes) OPT

XLS

 Developer Studio File Workspace Options

SubHeader

Excel Spreadsheet SubHeader

 FD FF FF FF xx xx xx xx

xx xx xx xx 04 00 00 00    (offset : 512 bytes)

 DB Thumbs.db SubHeader
 FE DB   or

FE DC

 SEQ Cyber Paint
 FE FF Byte-order mark for 16-bit Unicode Transformation

Format/2-octet Universal Character Set

(UTF-16/UCS-2)

 FF SYS Windows Executable Format File
 FF 00 02 00 04 04 05 54

02 00

 WKS Windows Spreadsheet Work File
 EF 46 4F 4E 54

F  O  N  T

 CPI Windows International Code Page
 FF 4B 45 59 42 20 20 20

K  E  Y  B

 SYS Keyboard Driver File
 FF 57 50 43

W  P  C

 WP, WPD, WPG

WP5

 Word processor – WordPerfect Document and

Graphic File

 FF D8 FF E0 xx xx 4A 46

J  F

49 46

I   F

 JPG

 

 Graphics – JPEG/JFIF Format

 

 FF D8 FF E1 xx xx 45 78

E  x

69 66

i   f

 JPG

 

 Graphics – JPEG/Exif Format – Digital Camera

Exchangeable Image File Format (EXIF)

 FF FF GEM GEM Metafile Format
 FF D8 FF E8 xx xx 53 50

S  P

49 46 46 00

I  F  F

 JPG

 

 Graphics – Still Picture Interchange File Format

(SPIFF)



출처 : http://forensic-proof.com

'Memory Forensic' 카테고리의 다른 글

포렌식 툴 모음  (0) 2018.09.08
파일 시그니처 모음  (0) 2018.09.08
디지털 포렌식 입문을 위한 툴  (0) 2018.09.08
메모리 포렌식 개념  (0) 2018.09.07

볼라틸리티 : https://www.volatilityfoundation.org/

오픈 소스 메모리 포렌식 프레임워크 버전 2.4이상 사용하자


파이썬 2.7이상 설치된 윈도우 os, 맥 os, 리눅스


메모리 수집 툴


IDA Pro와 Hex-Rays https://www.hex-rays.com/

코드를 디스어셈블 또는 디컴파일할 때 필요하다.


Sysinternals Suite 
실행되는 윈도우 시스템에서 흔적을 분석할 때 사용된다.


Wireshark http://wireshark.org


Microsoft WinDbg 디버거


YARA http://virustotal.github.io/yara/


FTK https://accessdata.com/products-services/forensic-toolkit-ftk


VMware나 VirtualBox

악성코드를 제어된 환경에서 실행할 경우 가상화 소프트웨어 환경이 필요하다.

'Memory Forensic' 카테고리의 다른 글

포렌식 툴 모음  (0) 2018.09.08
파일 시그니처 모음  (0) 2018.09.08
디지털 포렌식 입문을 위한 툴  (0) 2018.09.08
메모리 포렌식 개념  (0) 2018.09.07

예전에 컴퓨터는 HDD와 CPU가 한번에 통신해 사용했는데 너무 느리고 비휘발성이다.

지금은 CPU <-> RAM <-> HDD  HDD에서 RAM으로 올려서 이용한다.




리가 hello 프로그램을 만들어 내면 그것은  disk 안에 저장이 되어있다.

이걸 우리가 실행을 하면 BUS를 통해서 disk에서 메인 메모리 쪽으로 데이터를 이동시켜 로드시킨다. 그러면 CPU는 PC(프로그램 카운터)를 프로그램이 로딩되어 있는 메모리의 주소를 가리키고 거기서부터 인스트럭션을 한 줄씩 CPU로 가져와서 명령어를 디코딩하고 그걸 실행한후 그 결과를 메모리에 저장하는 방식으로 프로그램을 실행해 나가게 된다.




메모리 포렌식이란?

- 컴퓨터 하드웨어 중 주기억장치(메모리)에 존재하는 휘발성 데이터 덤프 분석하는 것을 말한다.


메모리 포렌식의 장단점

■ 장점

- RAM은 시스템이 활성화 되어 있는 동안 시스템 런타임 상태의 중요 정보를 포함하고 있음

- 언패킹, 루트킷 탐지, 리버스 엔지니어링 등에 도움이 된다.

■ 단점

- 휘발성 데이터로 전원 차단 시 데이터가 사라짐 [컴퓨터가 커져있어야함]

- 온전한 데이터 수집이 어렵다


메모리 덤프란?

- 램에 물리메모리에 저장되어있는 데이터를 가져와서 파일로 만드는 것이다.

그래서 물리 메모리에 존재하는 모든 흔적들을 확인할 수 있다.


메모리 포렌식 메모리 덤프하는 방법
1. 물리 메모리 덤프 방식
- 하드웨어를 이용한 덤프 : FireWire Attack(IEEE 1394)를 이용한 메모리 덤프, Tribble를 PCI 장치를 이용해 덤프
■ 장점
- 악성 프로그램에 영향을 받지 않는다. 
- 빠른 메모리 덤프 가능
- 무결성 최소화
■ 단점
- 안전성에 대한 검증이 필요하다
- 간혹 시스템 크래시 발생

2. 소프트웨어를 이용한 덤프 방식
DD, MDD, Winen, WIN32/64dd & Dumplt, Memorize ProDiscovery, HBGary, FastDumpPro, 크래시 덤프, 절전 덤프 등
■ 장점
- 추가 장치가 필요없다.
- 오픈소스 및 프리웨어가 많다.
■ 단점
- 커널 루트킷에 취약하다.
- OS 제약을 받는다.
- 수집하는 메모리쪽에 흔적이 남는다.

3. Virtual Machine Imaging
- VMware 세션이 정지되면 물리 메모리 내용은 .vmem 확장자를 가지는 파일에 포함된다.
- vmem은 로우 포맷과 유사하고 다른 메모리 분석 도구를 통해 분석 가능하다.
- 악성코드를 가상머신에 올리고 폴더에 보면 .vmem이 생기는데 이것을 이용해서 덤프를 뜰 수 있다.

4. 절전모드 덤프(Hibernation)

- 전력 관리를 보다 효율적으로 하기 위해 절전 상태에 돌입되면 하드 드라이브에 메모리 데이터를 기록한 다음 전력을 차단해 버리는 기능이다.

- 윈도우는 절전모드로 들어갈 경우 물리메모리 내용을 압축해 C:hiberfil.sys파일로 저장한다.

- 부팅 과정에서 hiberfil.sys가 설정되어 있으면 NTLDR에 의해서 메모리로 로드 된 후에 이전 상태로 돌아간다.

'Memory Forensic' 카테고리의 다른 글

포렌식 툴 모음  (0) 2018.09.08
파일 시그니처 모음  (0) 2018.09.08
디지털 포렌식 입문을 위한 툴  (0) 2018.09.08
메모리 포렌식 개념  (0) 2018.09.07

+ Recent posts

티스토리 툴바