signature based file identification