Acquire evidence
- Collect multiple versions, sizes and known application states.
- Create known input/output pairs by changing one value at a time.
- Preserve originals, hashes and provenance.
- Compare signatures, headers, offsets and repeated structures.
- Distinguish fixed records, length-prefixed/chunked structures and offset tables.
Interpret cautiously
| Text-like bytes | Test encoding, terminators and fixed/variable length. |
|---|---|
| Numeric candidates | Test endian order, signedness, scale, dates and floats. |
| High entropy | May indicate compression, encryption or packed data. |
| Changing tail/header | Length, checksum, directory or version metadata. |
Implement a defensive parser that validates lengths/offsets and rejects impossible structures. Test unseen files and document uncertain hypotheses rather than forcing every byte into a field.
This methodology differs from proprietary-file recovery, which evaluates extraction and damage. Use executable analysis to observe producers/consumers and the pillar for project scope.
Provide a representative corpus, producing application, known values and the required fields/operations.