Introduction

Hexadecimal

Using a hex editor

Figure 1

image shows a screenshot of the https://hexed.it user interface in the web browser.
screenshot of hexed.it’s user interface.

Figure 2

image shows our plain-text file as it would be viewed in a standard text editor, e.g. MS Notepad.
Hello World! Plain-text file.

Figure 3

image shows the hexadecimal representation of a plain-text file in a hex editor's user interface.
Hello World! Plain-text file in hexadecimal.

Figure 4

image shows the hexadecimal representation of a PDF file in a hex editor's user interface.
A small part of a PDF file shown in a hex editor.

Looking for patterns

Figure 1

image shows the hexadecimal representation of a JPEG file in a hex editor's user interface.
What would Trinity do?

Figure 2

image shows the hexadecimal representation of another JPEG file in a hex editor allowing us to identify differences in patterns.
Another JPEG for comparison.

Introducing PRONOM syntax

Reversing PRONOM syntax

Creating signature files

Figure 1

image shows the XML used to define a signature file used by DROID. It contains a lot of information used by previous DROIDs to optimize pattern matching.
A look at the XML used in a DROID signature file.

Figure 2

image shows the user interface of the signature development utility.
The Signature Development Utility.

Figure 3

image shows DROID user interface and where you would navigate to so that you can upload a new signature file.
You’re ready to run your signature file against real files!

Plugging it in

Doing it for yourself

Teaching us how to do it!

Advanced PRONOM

Figure 1

Image shows how a format identification is constructed in PRONOM by combining signature, priority, and metadta
Format identification result using PRONOM data.

Final thoughts