Information gathering tools

Knowing what we are dealing with prepares us further. For example, if a file were identified as a Windows executable, we then prepare Windows executable tools. Information gathering tools helps us identify what the file type is and its properties. The information gathered becomes a part of the analysis profile. These tools are categorized as file type identifying, hash calculating, text string gathering, and monitoring tools.

File type information

These tools gather primary information about a file. The data gathered includes the filename, file size, file type, and file type-specific properties. The result of these tools enables the analyst to plan how to analyze the file:

• PEiD: A tool used toidentifythe file type, the packer, and compiler. It is built to run in Windows. It is not maintained, but still very useful.
• TrID: A command-line tool similar to PEiD. This tool has Windows and Linux versions. It can read a community-driven signature database of various file...