I have access to a few thousand files binary files and I don't have the program that generated them. The files have been parsed and I also have access to the database where the parsed fields are stored. What techniques can be used to figure out the format of the files, given this information?
2
-
$\begingroup$ That's difficult!! Does the files have some associate information, like when they were created, the compiler or something like that? $\endgroup$– hoaphumanoidCommented Dec 26, 2015 at 17:20
-
$\begingroup$ Yes, the file name has creation date embedded in it and the records in the database can be approximately mapped to the source file using this date. $\endgroup$– ramana_kCommented Dec 26, 2015 at 17:51
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
I have had to perform that type of operation on so-called .DAT files. You need a good hexadecimal editor, that allows you to display char, binary and hex contents from binary, and some patience. And probably a digit-probe friend you can talk with, to help decipher the riddle.
Seek global headers and local ones, file ID, dates and try to locate numbers or ascii code from your database. With that, you can infer field storage length with a relative ease, as least as long they are not exotic, like multiple of 4 bits. Sometimes, there are dummy bits to fill blanks. If the file is somehow compacted (one chunk on 3 bits, the next on 17 bits), it can become quite complicated. Imagine you are a private investigator, challenge a geek friend. Performing such a task with another person can make it funnier.
