Sign in to follow this  
Followers 0
Champak

Detect if a file is a file that it says it is

7 posts in this topic

Is there a way to see if a file is the type of file it claims to be? Ex. when you try to play an mp3 file in wmp or some other media players, if it isn't really an mp3 file it will tell you that it isn't. Is it possible to detect if something is an mp3 file with autoit without looking at the extension?

Share this post


Link to post
Share on other sites



Hi,

The only thing i can think of is reading the header of the file.

But to do that you'd need a library of magic numbers/headers to compare against..

Cheers

Share this post


Link to post
Share on other sites

Maybe this could be a good place to start collecting information: "... Forensic applications need to identify file types by content"


My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (NEW 2017-04-18 - Version 1.4.8.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2017-02-27 - Version 1.3.1.0) - Download - General Help & Support - Example Scripts - Wiki
ExcelChart (2015-04-01 - Version 0.4.0.0) - Download - General Help & Support - Example Scripts
Excel - Example Scripts - Wiki
Word - Wiki
PowerPoint (2015-06-06 - Version 0.0.5.0) - Download - General Help & Support

Tutorials:
ADO - Wiki

 

Share this post


Link to post
Share on other sites

#4 ·  Posted (edited)

Depending on how many file types you need to identify, this tool http://mark0.net/soft-trid-e.html might be useful. Command line version is suitable for scripting, and there is also a GUI version.

Edit: Spelingg

Edited by ResNullius

Share this post


Link to post
Share on other sites

Thanks, I'll take a look at TrID as soon as I get a chance. Any idea how fast it is...split second, or it takes a bit to analyze? Need to know if it will be a waste with 1000+ files at once.

Share this post


Link to post
Share on other sites

Why don't you just read the first characters of the file?

An mp3 file usualy starts with the characters ID3, and thats the only thing (most) forensic applications check.

Share this post


Link to post
Share on other sites

Thanks for letting me know that. If that is the case, then it wouldn't work anyway. What I was trying to do is detect "corrupted" mp3 files. I figured that for whatever reason a corrupted mp3 wouldn't show up as an mp3 file....since media players are crapping out or telling me that the files are not mp3s. The ID3 is there regardless of if the file is "corrupted" or not. So I guess I have to figure a different way to do this.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0