MITRE D3FENDdefensive technique
D3-FCDC File Content Decompression Checking
- Tactic
- Isolate
Definition
Checking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledge
How it works
How it works
Some file formats such as JPEGs include encoded or compressed sections. This technique verifies that those expected sections are present and can be properly decoded according to the spec.
Related
Child of · MITRE D3FEND (1)
- D3-FFV File Format Verification defensive technique
References
- https://www.sciencedirect.com/science/article/pii/S1742287607000369?viewFullText=true#sec4 Carving Contiguous and Fragmented Files with Fast Object Validation
- https://pure.uva.nl/ws/files/1739225/132135_thesis.pdf Gathering Evidence: Model-Driven Software Engineering in Automated Digital Forensics