Read structure from controlled comparisons
- Preserve samples and compare files that differ in one known value.
- Mark signatures, version bytes, lengths, offsets and candidate record boundaries.
- Test integer widths, signedness and little- or big-endian interpretation.
- Locate strings and verify encoding, termination and fixed versus variable length.
- Compare repeated structures for padding, alignment and optional fields.
- Check whether stored offsets are absolute, relative or table-based.
A plausible decoded number is not proof. It should remain consistent across samples and predict how a controlled input change alters the bytes.
Recognize transformation indicators
| Low/repeated entropy | Padding, sparse fields or simple record structure may be present. |
|---|---|
| High entropy | Compression, encryption or already-compressed payloads are possibilities, not conclusions. |
| Stable header, changing tail | Directory, checksum, footer or append-only data may be involved. |
| Regular offset jumps | Fixed records, aligned chunks or an index table may explain them. |
Write small defensive parsers that validate bounds and impossible values. Test them on unseen samples and record confidence and counterexamples for every inferred field.
The broader file-format methodology covers experimental planning; proprietary-format recovery focuses on extracting usable data. Use the reverse-engineering pillar for system scope.