SOURCE IDENTIFYING FORENSICS SYSTEM, DEVICE, AND METHOD FOR MULTIMEDIA FILES
A system configured to perform a forensic analysis of a file including: one or more processors; and a memory storing computer-readable instructions that, when executed by the one or more processors, cause the system device to: receive one or more files for analysis; identify a file format for the file; determine whether the file format is a supported multimedia file; parse the file to separate structural elements from the file; generate a profile structural signature for the one or more files; a database including a plurality of profile structural signatures corresponding to known hardware and/or software; determining whether the one or more files matches one of the plurality of profile structural signatures; and providing an indication of an identity of the known hardware and/or software for the one or more files upon a determination that the one or more files matches one of the plurality of profile structural signatures. A method for performing a forensic analysis of a file is also disclosed.
1 - 19 . (canceled)
20 . A method, comprising:
receiving a multimedia file for analysis;
parsing the multimedia file to separate structural elements of the multimedia file; and
generating at least one profile structural signature for the multimedia file based on the parsed multimedia file, the at least one profile structural signature characterizing an appearance of a structure heading within the multimedia file, a position of the structure heading within a sequence of a plurality of structure headings within the multimedia file, and a relative depth of the structure heading within a hierarchy of the plurality of structure headings within the multimedia file.
21 . The method of claim 20 , further comprising:
determining a percentage match of the generated at least one profile structural signature with a plurality of stored profile structural signatures; and
providing an indication of at least one of hardware and software corresponding to at least one of the plurality of stored profile structural signatures when at least one of the plurality of stored profile structural signatures has a percentage match with the generated at least one profile structural signature that satisfies a predetermined value.
22 . The method of claim 20 , wherein:
the generated at least one profile structural signature includes at least a first structural signature and a second structural signature;
the first structural signature includes a first grouping of data structures; and
the second structural signature includes a second grouping of data structures, the second grouping including a greater number of data structures than the first grouping.
23 . The method of claim 22 , wherein:
the second grouping includes at least one trak structure for MP4, MOV, 3G2, 3GP, and M4V files or the first grouping excludes the at least one trak structure.
24 . The method of claim 21 , further comprising:
determining a classification of data structures and semantic metadata contained in the generated at least one profile structural signature with respect to the plurality of stored profile structural signatures.
25 . The method of claim 21 , further comprising:
normalizing the generated at least one profile structural signature; and
wherein, at the step of determining a percentage match, the normalized profile structural signature is compared to the plurality of stored profile structural signatures.
26 . The method of claim 25 , further comprising:
storing the normalized profile structural signature in a database.
27 . The method of claim 20 , wherein the parsing of the multimedia file to separate structural elements of the multimedia file comprises performing a plurality of media byte analyses.
28 . The method of claim 27 , wherein the performing of the plurality of media byte analyses includes:
parsing structural elements contained in the multimedia file; and
parsing semantic metadata contained in the multimedia file.
29 . The method of claim 20 , further comprising:
performing one or more validation tests based on the generated at least one profile structural signature;
performing one or more modification byte analysis test.
30 . A system, comprising:
at least one data processor; and
a memory storing computer-readable instructions that, when executed by the at least one data processor, cause the system to implement operations comprising:
receiving a multimedia file for analysis;
parsing the multimedia file to separate structural elements of the multimedia file; and
generating at least one profile structural signature for the multimedia file based on the parsed multimedia file, the at least one profile structural signature characterizing an appearance of a structure heading within the multimedia file, a position of the structure heading within a sequence of a plurality of structure headings within the multimedia file, and a relative depth of the structure heading within a hierarchy of the plurality of structure headings within the multimedia file.
31 . The system of claim 30 , wherein the operations further comprise:
determining a percentage match of the generated at least one profile structural signature with a plurality of stored profile structural signatures; and
providing an indication of at least one of hardware and software corresponding to at least one of the plurality of stored profile structural signatures when at least one of the plurality of stored profile structural signatures has a percentage match with the generated at least one profile structural signature that satisfies a predetermined value.
32 . The system of claim 30 , wherein:
the generated at least one profile structural signature includes at least a first structural signature and a second structural signature;
the first structural signature includes a first grouping of data structures; and
the second structural signature includes a second grouping of data structures, the second grouping including a greater number of data structures than the first grouping.
33 . The system of claim 32 , wherein the second grouping includes at least one trak structure for MP4, MOV, 3G2, 3GP, and M4V files or the first grouping excludes the at least one trak structure.
34 . The system of claim 31 , wherein the operations further comprise:
determining a classification of data structures and semantic metadata contained in the generated at least one profile structural signature with respect to the plurality of stored profile structural signatures.
35 . The system of claim 31 , wherein the operations further comprise:
normalizing the generated at least one profile structural signature; and
wherein, at the step of determining a percentage match, the normalized profile structural signature is compared to the plurality of stored profile structural signatures.
36 . The system of claim 35 , wherein the operations further comprise:
storing the normalized profile structural signature in the database.
37 . The system of claim 30 , wherein the parsing of the multimedia file to separate structural elements of the multimedia file comprises performing a plurality of media byte analyses.
38 . The system of claim 37 , wherein the performing of the plurality of media byte analyses includes:
parsing structural elements contained in the multimedia file; and
parsing semantic metadata contained in the multimedia file.
39 . A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing system, cause the at least one data processor to implement operations comprising:
receiving a multimedia file for analysis;