hemu1438/forensicsgpt-training-data huggingface dataset:
Excel spreadsheet (xls) -
The Excel Spreadsheet (XLS) file format has the .xls extension. This file type originates from Microsoft Excel. However, other spreadsheet software can be used to display these files as well. These include:
OpenOffice
WordPerfect
The XLS file format should not be confused with XLSX and XSLB.
MIME types
The following MIME types apply to this file format:
application/msexcel
application/xls
File signature
Microsoft Excel spreadsheets of version 97-2003 use the OLE Compound File (OLECF). These files therefore have the OLECF file signature.
The object stream of the OLECF containing a Excel spreadsheet contains the string "..." with some version.
Excel 97-2003 spreadsheets
The Excel 97-2007 Binary File format is stored in the OLECF using multiple streams:
Workbook stream
Encryption
See Word Document (doc). Note: perhaps this section should be moved to a separate section about Microsoft Office encryption
See Also
External Links
Excel 97-2007 Binary File format by Microsoft
Excel 2007 Binary File format by Microsoft
Excel spreadsheet (xlsx) -
The Excel Spreadsheet (XLSX) file format has the .xlsb extension. This file type originates from Microsoft Excel. However, other spreadsheet software can be used to display these files as well. These include:
OpenOffice
MIME types
File signature
Microsoft Excel spreadsheets of version 2007 are stored in a ZIP archive file. These files therefore have the ZIP file signature.
See Also
Excel Spreadsheet (xls)
Excel Spreadsheet (xlsb)
Encase hash files -
The EnCase forensics suite uses a proprietary file format to store sets of known hashes called the EnCase hash file format. The format stores a set of MD5 hashes and metadata about the set as a whole. That is, individual hashes do not contain any information specific to them, but the set as a whole can contain some information. In particular, the filename corresponding to each hash is not stored.
Version 3 of EnCase used a slightly different format than versions 4 and 5. Both versions start with the header, in hexadecimal:
48 41 53 48 0d 0a ff 00 
In ASCII, this looks like HASH followed by a newline.
The hashes begin at offset 0x480 in the file.
A quick look at a hash file created by Encase 6.8.1.8 revealed the following structure (to be verified):
Offset 0x0000
A header that consists of the following 16 bytes:
48 41 53 48 0D 0A FF 00 02 00 00 00 01 00 00 00 
Offset 0x0010
Count: The number of MD5 sums contained in this file, written as a 4 byte integer in Intel litle endian format (i.e. least significant byte first).
Offset 0x0014
The range from 0x0014 to 0x0407 is filled by zero-bytes. The purpose of this area is unknown.
Offset 0x0408
HashSet: The text that EnCase shows in its column "Hash Set". The maximum string length is 39 characters. Characters are stored in Unicode. (Based on hash file form EnCase v. 6.17)
Offset 0x0458
Category: The text that Encase shows in its column "category". The maximum string length is 19 characters. Each character is written as a 2-byte-Unicode-number. Examples:
The latin letter A is represented by the 2 bytes
41 00 
The cyrillic letter Д is represented by the 2 bytes
14 04 
Again, Intel little endian format is used. The unused space is filled up by zero-bytes.
Offset 0x047E
Two zero-bytes.
Offset 0x0480
Start of the hash entries. Each entry occupies 18 bytes: The hash value itself (16 bytes) followed by 2 zero-bytes. The next entry follows immediately.
The file ends with the last hash entry.
See also
EnCase
Excel spreadsheet (xlsb) -
The Excel Spreadsheet (XLSB) file format has the .xlsb extension. This file type originates from Microsoft Excel. However, other spreadsheet software can be used to display these files as well. These include:
OpenOffice
MIME types
File signature
Microsoft Excel spreadsheets of version 2007 are stored in a ZIP archive file. These files therefore have the ZIP file signature.
See Also
Excel Spreadsheet (xls)
Excel Spreadsheet (xlsx)
Excel 2007 Binary File format by Microsoft
Gif -
The Graphics Interchange Format (GIF) (SM) format is a lossless image format. GIF images use internal LZW compression to reduce file size. CompuServe created this format, which is a bitmap image format allowing 256 different colors to be selected from a 24-bit color palette (RGB). GIF also allows for animations by sequencing through multiple GIF image data inside a single file.
"The Graphics Interchange Format(c) is the Copyright property of CompuServe Incorporated. GIF(sm) is a Service Mark property of CompuServe Incorporated."
Format
GIF files consist of a header, image data, optional metadata, and a footer. The header consists of a signature and a version, each 3 bytes long. The signature is 47 49 46 (hex) / GIF (text). The versions are either 38 37 61 or 38 39 61 (hex) / 87a or 89a (text) respectively. The footer or trailer (as identified in the format specification) is usually 3B (hex).
Common file extensions are .gif and .GIF
GIF89a files can contain metadata in text format. GIF metadata is contained in sections identified as a Comment Extension, a Plain Text Extension, and an Application Extension. All extension sections begin with the Extension Introducer 21 (hex).
Comment Extensions are optional and more than one may be present. They were designed to allow including comments about the graphic, credits, descriptions or other types of non-control/non-graphic data. The beginning of this block has the Extension Introducer and a Comment Label FE (hex). Comment data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data. Comment Extensions should appear either before or after the control and graphic data blocks.
Plain Text Extensions are optional and more than one may be present. They were designed to allow rendering of textual data as a graphic. The beginning of this block has the Extension Introducer and a Comment Label 01 (hex). Plain text data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data.
Application Extensions are optional. They were designed to allow applications to insert application specific data inside a GIF. The beginning of this block has the Extension Introducer and an Application Extension Label FF (hex).
External Links
Wikipedia: GIF
W3.Org: GRAPHICS INTERCHANGE FORMAT SPECIFICATION
File formats -
A file format defines the structures of the data in a file.
File formats can be:
either proprietary or public.
either closed specification or open specification.
A proprietary file format is a file format where "official" changes are restricted to one or more parties, often the intellectual property holder, e.g. the author. In contrast to a public (open or free) file format, where file format changes are open to the public, e.g. Request for Comments (RFC). This does not mean that all proposed changes to the format are necessarily adopted by the "official" standard.
A file format is considered closed specification when no "official" information about the format is published by the intellectual property holder. In contrast to open specification where the intellectual property holder has published the format specification or at least parts of it.
External Links
Wikipedia: File format
Wikipedia: Proprietary format
Digital preservation: alphabetical list
Funky File Formats, by Ange Albertini, December 29, 2014
Firefox disk cache format -
There are multiple versions of the Firefox Disk Cache format:
Cache version 1
Cache version 2 - default as of firefox 32 1
Cache version 1
The Cache directory contains the multiple type of cache files:
Cache Map File
Cache Block File
Cache Data File
Cache Map file
File named CACHE_MAP
Contains:
Cache Map file header
An array of Cache Map buckets
There are 32 buckets in the Cache map file. Within each bucket, there are 256 records inside each bucket, hence the Cache Map file contains 8192 records in total.
Each record contains the information for one instance of cache data. A record contains four 32-bit integers:
A Hash Number
An Eviction Rank
The Data Location
The Metadata Location
Cache Block file
File named CACHE_00#, where # is a number ranging from [1-3].
Cache Data File
File named:
<hash number><type><generation number> 
Where , , are placeholders for the corresponding values.
Cache version 2
cache2/index cache2/doomed/* cache2/entries/* 
See Also
Mozilla Firefox
gzip
External Links
Mozilla wiki: Necko/Cache
Web Browser Forensics, Part 2, by Keith J. Jones, Rohyt Belani, May 10, 2005
Firefox Cache Format and Extraction, by John Ritchie, March 9, 2012
Common log file system (clfs) -
The Common Log File System (CLFS) is a special purpose file (sub)system designed for transaction logging and/or recovery. The CLFS is not a file system in the traditional meaning of a disk file system, but more of a logical (special purpose) file system that operates in combination with a disk file system like NTFS.
Overview
A CLFS log consists of a base log file (.blf) and one or more container files.
There are two types of logs:
dedicated logs; contains a single stream of log records.
multiplexed (or common) logs; contains several streams of log records.
Implementation
According to Wikipedia CLFS was introduced in Windows server 2003 R2.
In Windows Vista the CLFS is implemented as a driver named: clfs.sys. User space equivalent functionality is provided by clfsw32.dll, which communicates to the driver by DeviceIoControl calls.
Also see
Windows Internals 5 by Mark E. Russinovich and David A. Solomon
External links
MSDN on Common Log File System
Wikipedia on Common Log File System
Common Log File System (CLFS), by the libfslibs project, November 2010
Iximager file formats -
ILook Investigator v8 and its disk-imaging counterpart, IXimager, offer three proprietary, authenticated image formats:
compressed (IDIF)
non-compressed (IRBF)
encrypted (IEIF)
Although few technical details are disclosed publicly, IXimager's online documentation provides some insights: IDIF "includes protective mechanisms to detect changes from the source image entity to the output form" and supports "logging of user actions within the confines of that event;" IRBF is similar to IDIF except that disk images are left uncompressed; IEIF, meanwhile, encrypts said images.
For compatibility with ILook Investigator v7 and other forensic tools, IXimager allows for the transformation of each of these formats into raw format.
The header for these image formats appears to contain the string: RiPed_By_ILookImager e.g.
00000000 7f 52 69 50 65 64 5f 42 79 5f 49 4c 6f 6f 6b 49 |.RiPed_By_ILookI| 00000010 6d 61 67 65 72 00 01 70 03 00 dc 23 65 d6 15 19 |mager..p...#e...| 00000020 00 a1 81 87 d0 f4 69 a1 00 00 00 00 00 00 00 00 |......i.........| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 
External Links
Sample image in EnCase, iLook, and dd format, From the Computer Forensic Reference Data Sets Project
Hiberfil.sys -
hiberfil.sys is the file used by default by Microsoft Windows to save the machine's state as part of the hibernation process. The operating system also keeps an open file handle to this file, so no user, including the Administrator, can read the file while the system is running.
Although often presumed, the size of the hiberfil.sys is not one-to-one in size to the available, or total RAM of the machine.
The data structures required to parse the file format are available in the Microsoft Windows debug symbols, including some of the various compression methods used.
The Xpress compression was reverse engineered by Matthieu Suiche. He created with Nicolas Ruff a project called Sandman is the only open-source tool that can read and write the Windows Vista and 7 hibernation files.
In early 2008, as part of the Windows Server Protocol Program, Microsoft released documentation on the Xpress compression algorithm in the Directory Replication Service (DRS) Remote Protocol specification (section 4.1.10.6.15, "DecompressWin2k3").
Windows Version Compression 
ME and earlier	none	
2000	LZNT1 (LZ77 variant)	
Vista, 7	Xpress (LZ77 and direct2)	
Hibernation Recon is a commercial digital forensics tool launched in late 2016. In addition to memory reconstruction from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files, Hibernation Recon also identifies and extracts data from the multiple levels of slack space within them.
External Links
Microsoft Hibernation Files, by the Volatility project
Parsing hibernation slack space
LZ XPRESS
DIRECT2 Encoding Algorithm, by Microsoft
Jpeg -
The Joint Photographic Experts Group (JPEG) format is a commonly-used lossy image format.
Format
JPEG is a container file format that consist of a well defined header, some metadata, icons, a color table, compressed data, and a well defined footer.
Common file extensions are .jpg, .jpeg, .JPG, .JPE, and .jfif.
JPEG files can contain lots of metadata in several formats, such as Exif, IPTC, GPS, or Camera Raw.
The exif and jhead command tools can extract and manipulate some of that metadata. Adroit Photo Forensics can be used to extract, view and group metadata from JPEG and camera Raw files.
Also see
exif
Externals Links
JPEG File Interchange Format Version 1.02
Adobe: XMP Specification
Extensible Metadata Platform (XMP)
FlashPix Tags
ISO/IEC 10918-1, Section: Annex B contains a detailed description of the JPEG file structure.
Wikipedia: ICC profile
Wikipedia: JPEG
Kaspersky report file -
The Kaspersky Anti-Virus report files are stored in a propriety file format.
The following information is based on the current understanding of the Kaspersky Report File format.
Overview
A Kaspersky Report File consists of:
file header
log record index
array of log records
The file header is 80 bytes of size and consists of:
Offset
Size
Value
Description
0
	
4
	
"RPD2"
	
Signature
	
4
	
4
	
2
	
Unknown, version?
	
8
	
8
		
Unknown (empty values?)
	
16
	
4
		
Unknown A
Next available record number or 0?
	
20
	
4
	
0x1000
	
Unknown (record index size?)
	
24
	
4
		
Unknown (Record offset?)
	
28
	
4
		
Unknown (empty value)
	
32
	
4
		
File size
	
36
	
4
		
Unknown (empty value)
	
40
	
8
		
Unknown timestamp
Creation time?
	
48
	
8
		
Unknown timestamp
Last write time?
	
56
	
8
		
Unknown timestamp
Access time?
	
64
	
8
		
Unknown (empty values?)
	
72
	
4
		
Next available record number?
	
76
	
4
		
Unknown (empty value)
	
Log records index
Log records index entry
The file header is 80 bytes of size and consists of:
Offset
Size
Value
Description
0
	
4
		
Record offset
The offset is relative to the start of the file
	
4
	
4
		
Unknown (empty value)
	
8
	
4
		
Record number
	
12
	
4
		
Unknown (empty value)
	
				
Log records
Offset
Size
Value
Description
0
	
4
		
Log record data size
Log record size = Log record data size + 12
	
4
	
8
		
Unknown timestamp
Creation time?
	
12
	
...
		
Log record data
	
				
Log record data
The record data contains some types, followed by the data. Currently it is assumed that the record data format is (partially) dependent on the subsystem, e.g. on-access scan (oas), that generated the log record data.
Date and time values
The date and time values are stored in intervals of 10 ns since January 1, 1 00:00:00 local time.
E.g. the timestamp: 0x582db22720fb9bc9
import datetime print datetime.datetime(1, 1, 1) + datetime.timedelta(microseconds=0x582db22720fb9bc9 / 100) 2014-06-25 15:01:44.164668 
See Also
Kaspersky Anti-Virus
Kaspersky Quarantine File
Kaspersky quarantine file -
The Kaspersky Anti-Virus quarantined files are stored in a propriety file format.
The following information is based on the current understanding of the Kaspersky Quarantine File format.
Overview
A Kaspersky Quarantine File consists of:
file header
obfuscated quarantined file
obfuscated metadata
The file header is 64 bytes of size and consists of:
Offset Size Value Description 
0	4	"KLQB"	Signature	
4	4	1	Unknown, version?	
8	4		Unknown, header size or offset to quarantined file data?	
12	4		Unknown, empty values?	
16	4		Unknown, offset to metadata?	
20	12		Unknown	
32	4		Unknown, size of metadata?	
36	4		Unknown, empty values?	
40	4		Unknown, header size?	
44	4		Unknown, empty values?	
48	4		Unknown, quarantined file size?	
52	4		Unknown, empty values?	
56	4	1	Unknown	
60	4		Unknown, empty values?	
				
Quarantined file
The quarantined file is stored obfuscated using an 8 byte XOR key: "e2 45 48 ec 69 0e 5c ac".
How the metadata is stored is not fully known at the moment but part of the metadata is stored obfuscated using an 8 byte XOR key: "48 ec 69 0e 5c ac e2 45".
Date and time values
The date and time values in the metadata are stored in intervals of 10 ns since January 1, 1 00:00:00 local time.
E.g. the timestamp: 0x582db22720fb9bc9
import datetime print datetime.datetime(1, 1, 1) + datetime.timedelta(microseconds=0x582db22720fb9bc9 / 100) 2014-06-25 15:01:44.164668 
See Also
Kaspersky Anti-Virus
Kaspersky Report File
Microsoft office file formats -
Office versions, applications and file formats
pre 95 DOS versions
pre 95 Windows versions
Microsoft Word 6.0
Microsoft Office 95
Microsoft Office 97 - 2003
Uses the OLE Compound File format for most of the file formats
Microsoft Word uses the Word Document (doc) file format
Microsoft Excel uses the Excel Spreadsheet (xls) file format
Microsoft PowerPoint uses the PowerPoint Presentation (ppt) file format
Microsoft Publisher
Microsoft Visio
Microsoft Outlook uses multiple file formats for different purposes
the Personal Folder File (PAB, PST, OST) format to store e-mails, appointments, tasks, notes, contacts, etc. The PFF format changed from a 32-bit to a 64-bit version in Outlook 2003.
the Nickfile (nk2) format to store e-mail address aliases
Microsoft Access uses a file format based on Microsoft Joint Engine Technology (JET)
Microsoft Office 2007
Uses the ZIP archive file format for most of the file formats
Microsoft Word uses the Word Document (docx) file format
Microsoft Excel uses the Excel Spreadsheet (xlsb) and Excel Spreadsheet (xlsx) file formats
Microsoft PowerPoint
Microsoft Publisher
Microsoft Visio
Microsoft Outlook
Microsoft Access
See Also
Tools:Document Metadata Extraction
External Links
Microsoft.com links
Introducing the Office (2007) Open XML File Formats
Microsoft Office Binary File Format Documents
Microsoft: File format reference for Word, Excel, and PowerPoint
Ecma Office Open XML File Formats overview
Introduction to new file name extensions and Open XML Formats
Evaluations
Why are the Microsoft Office file formats so complicated? (And some workarounds)
Wikipedia
Wikipedia article on Microsoft Word
Wikipedia article on OLE
Microcode -
From Wikipedia:
Microcode is a layer of hardware-level instructions that implement higher-level machine code instructions or internal state machine sequencing in many digital processing elements. Microcode is used in general central processing units, in more specialized processors such as microcontrollers, digital signal processors, channel controllers, disk controllers, network interface controllers, network processors, graphics processing units, and in other hardware.
Linux
In Linux the CPU microcode can be stored in the initial ramdisk (initrd) e.g.
kernel/x86/microcode/GenuineIntel.bin kernel/x86/microcode/AuthenticAMD.bin 
The initrd is a (compressed) cpio archive.
External Links
Wikipedia: Microcode
The Linux Microcode Loader, by Fenghua Yu, Borislav Petkov, Ashok Raj
Security Analysis of x86 Processor microcode, by Daming D. Chen, Gail-Joon Ahn, December 11, 2014
ODL/ODLGZ Log files -
Microsoft OneDrive stores logs in a proprietary binary format that have file extension .odl/.odlgz.
File Locations
Windows 10/11
C:\Users\<USER>\AppData\Local\Microsoft\OneDrive\logs\Business1
C:\Users\<USER>\AppData\Local\Microsoft\OneDrive\logs\Common
C:\Users\<USER>\AppData\Local\Microsoft\OneDrive\logs\Personal
Mac OSX
/Users//Library/Logs/OneDrive/
External links
Reading OneDrive Logs, by Yogesh Khatri, February 13, 2022
Reading OneDrive Logs Part 2, by Yogesh Khatri, November 4, 2022
Pagefile.sys -
Microsoft Windows uses a paging file, called pagefile.sys, to store frames of memory that do not current fit into physical memory. Although Windows supports up to 16 paging files, in practice normally, only one is used. This file, stored in %SystemDrive%\pagefile.sys is a hidden system file. Because the operating system keeps this file open during normal operation, it can never be read or accessed by a user. It is possible to read this file by parsing the raw file system (e.g. using The Sleuth Kit.
Analysis Options
Data is stored in the paging file when Windows determines that it needs more space in physical memory. Because storage locations in the paging file are not necessarily sequential, it is unlikely to find consecutive pages there. Although it is possible to find data in chunks smaller than or equal to 4KB, it's the largest an examiner can hope for.
Sadly, the most productive method to date for analyzing paging files is searching for strings. It is possible to carve out files, but as noted, the examiner is unlikely to find anything larger than 4KB. Also, bulk-extractor can be used to extract streams from the page file.
Artifacts details
Executable file fragments: Any executable file fragments found in the page file may have been downloaded, extracted from a zip file, or run from a network share
See Also
Windows Memory Analysis
External Links
Acquisition and Analysis of Windows Memory, by Nicholas Maclean, 2006. Thesis on Windows memory analysis and discusses the paging file.
Using Every Part of the Buffalo in Windows Memory Analysis, by Jesse Kornblum in 2006. A paper discussing the different states of memory including where to find data in the paging file.
Tools
bulk-extractor
page_brute
Nickfile (nk2) -
Microsoft Outlook uses the Nickfile (NK2) to store e-mail address aliases.
The file type is also known as the Outlook AutoComplete File or the Nickname file.
MIME types
The actual mime type of the NK2 format is unspecified
File signature
The NK2 has the following file signature: hexadecimal: 0D F0 AD BA
Note that other sources claim that the file signature is hexadecimal: 0D F0 AD BA 0A 00 00 00
Contents
The NK2 basically contains a list of items. The attributes of these items are defined by the Microsoft Outlook Message API (MAPI).
External Links
Nickfile (NK2) format specification, by the libnk2 project
MAPI definitions, by the libfmapi project