File Fragment Type Detection By Neural Network

Abstract

File type detection is vital for data recovery, cyber attack detection and, and digital forensic studies. There are extension based, knowledge of file header, and content based methods for file type detection. Extension based and knowledge of file header based methods aren't robust methods since file header and extension can be easily changed. Content based methods have been investigated in the recent years since content based methods are resistant to changes such as file header and extensions. In this paper, a content based file fragment type detection method based on neural network is presented. In this method, the features of the data belonging to the most common 7 file type were extracted by using 2-gram analysis and a neural network was trained and tested using the extracted features, and the performance of the file fragment type detection is evaluated in terms of accuracy. The 4096 and 8192-byte sizes which are the smallest chunk sizes stored in the operating system, are used, and 98.86% and 99.2% accuracies are obtained respectively. These results show that our study has higher file type detection accuracy of more file types than other content-based methods using file fragments in the literature.