Sliding Window Measurement for File Type Identification

Knowing the file type associated with a sequence of bytes makes interpretation of those bytes far more meaningful. With the ever increasing number of file types in existence and the massive storage capacity of modern hardware, it is impractical to try interpreting a sequence of bytes as every known file type until one succeeds. Furthermore, some file types require specific header or footer information that, if missing, makes the data unusable. This paper presents new measurements that can be used to assist in determining the file type associated with a file of unknown type. These measurements can be used by a variety of algorithms to attempt to determine file type. Initial results are presented and avenues for future research are discussed.