IASA 2018 Annual Conference

Every complex digital file format requires the presence of self-describing and predictable internal binary structures. This internal structure is responsible for framing the stored content within the file so playback software can acquire the correct configuration details to reconstitute this encoded information. This applies to videos (e.g., mp4, mov, avi), audio files (e.g., wav, mp3), still images (e.g., jpg, tif, png), serialized packages (e.g., zip, tar), database files (e.g., sql), and file systems (e.g., FAT32, HFS), among many other content types.

Traditional approaches to digital file forensics focus on the content of the file itself. Signal analysis takes the output of the reconstructed payload of the file and processes this output to identify traces that are targets of the particular investigation method. Semantic analysis identifies recognizable text that can be examined for further meaning. Signal and semantic analysis of digital media are both necessary and fruitful approaches. Our research indicates that an additional approach, structural analysis, which targets the internal structure (or, the syntax) of digital file formats, is a viable method to identify provenance, to detect tampering, and to propose approaches to file repair or reconstruction.