MITRE D3FENDdefensive technique
D3-FMCV File Metadata Consistency Validation
- Tactic
- Isolate
Definition
The process of validating the consistency between a file's metadata and its actual content, ensuring that elements like declared lengths, pointers, and checksums accurately describe the file's content.
How it works
How it works
This technique involves validating the consistency between a file's metadata and its actual content. It checks elements like declared lengths, pointers, and checksums to ensure they accurately describe the file's content. For instance, if a header specifies a content block of 50 bytes, this should be verified, and CRC values should be recalculated and compared.
Related
Child of · MITRE D3FEND (1)
- D3-FFV File Format Verification defensive technique
References
- https://pure.uva.nl/ws/files/1739225/132135_thesis.pdf Gathering Evidence: Model-Driven Software Engineering in Automated Digital Forensics