What utility or method can tell a file type accurately?

5

3

If we look at files in our browser's cache, usually there is no file extension (the gif, jpg, or swf).

Is there a reliable and trustworthy app that can tell whether a file is a gif, jpg, png, swf, avi, wmv, etc, etc?

I have seen an app like that before but the icon / website of it looked very 3rd party and unprofessional.

nonopolarity

Posted 2009-10-30T03:17:36.897

Reputation: 7 932

Answers

6

  • Trid - "TrID is an utility designed to identify file types from their binary signatures. While there are similar utilities with hard coded rules, TriID has no such rules. Instead, it is extensible and can be trained to recognize new formats in a fast and automatic way."
  • File - "File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests." (it's for UNIX but under Windows you can use Cygwin)

Hugh Allen

Posted 2009-10-30T03:17:36.897

Reputation: 8 620

2

You know, there are tools specifically for exploring a browser cache... The browser has an index of the cache contents that usually includes MIME type as well as original URL.

I haven't used such a tool since the late 90's but I'm sure they still exist.

Here's a post that reviews browser cache viewer products for three major browsers

A quick search for more browser cache viewers turns up:

  • CacheAuditor
  • CacheViewX
  • CacheView
  • VideoChacheView
  • MozillaCacheView

Here's another post about viewing the browser cache of Firefox.

If you are determined to do it the hard way, there is a computer forensic information site that lists some commercial tools for the purpose of "File viewer- to view and/or identify file format regardless of extension" for forensics purposes. It lists: Quick View Plus5, EnCase, Turbo Browser 98, DiskJockey 98" which I've never heard of and seem a bit dated, but many of the file formats in the browser cache were around 10 years ago.

Looking for modern and capable tool like that would be interesting. My searches didn't turn up anything amazing in this space. There are so-many file formats and this is such a specialized area, that it wouldn't really attract a shareware developer or an open source community. If these tools exist and are kept up to date with the latest format changes, my guess is that they will be priced appropriately for a forensic investigator's budget. (very expensive)

Again, you'd be better off approaching it using what the browser cache already knows about its contents rather than brute-forcing the naked files.

DanO

Posted 2009-10-30T03:17:36.897

Reputation: 2 494

1

You can use File for Windows. It behaves like the UNIX file utility.

C:\Documents and Settings\Administrator>file file.c
file.c:   C program text

John T

Posted 2009-10-30T03:17:36.897

Reputation: 149 037

so you can say "file abc" and it will say abc is indeed a GIF or JPG or SWF, etc? – nonopolarity – 2009-10-30T03:48:31.950

@Jian Lian - yes – warren – 2009-10-30T06:21:54.823

0

There can be no general tool for accomplishing what you ask. File types are used and assigned somewhat arbitrarily by developers whose only criterion is sometimes that the type not already exist. Even then, duplicates exist.

But using the above advice and some tools, you may be able to identify at least the more common types. File Identifier is a good place to start. A similar tool also accompanies "CD/DVD Diagnostic" by Infinadyne.

Abraxas

Posted 2009-10-30T03:17:36.897

Reputation: 1 269

0

Open it in Text Editor. Most files start with the type and some readable comments in the first lines of the binary. It really shows a lot of information in these cases.

bert

Posted 2009-10-30T03:17:36.897

Reputation: 931

-1

Can't you just go Tools/Folder Options/View/, check Show hidden files and folders and also uncheck Hide extensions for known file types?

Blackbeagle

Posted 2009-10-30T03:17:36.897

Reputation: 6 424

4no, the files in this case really have NO extension. they are not hidden, but doesn't exist at all. – nonopolarity – 2009-10-30T03:34:57.767