There are thousands of file types, some of which have been standardized.
When file types are standardized, a signature -- or header -- is recognized by
the program the file belongs to. For example, if one were to see a .DOC
extension, it is expected that a program like Microsoft Word would open this
file.
 
One tactic in trying to hide data is to change the 3 letter file extension on a file
or to remove the extension altogether.
 
Performing a signature analysis identifies which files may have been altered to
hide their true function.

- Return to FAQ -