Type File Details
| Defined Constant | Type_File_Details
|
| File Type Value | 118 |
| Parent Type | JSON |
| Carve | No |
| Format Details | No |
| MIME Type | application/json
|
| Filename Extension | json
|
File Details
Contents
Description
Details extracted from the file format.
Details
File details are fields within the file's format are extracted, normalized, interpreted and written to a JSON file that you can use to do further analysis.
This file is the source of information displayed to the user when clicking on "Additional Details" tab when viewing a file's contents. It was created to hold information that may be useful for other tools. Let's take a look at some file details for a Windows 32-bit executable:
[
{
"Label": "Original Filename",
"Meaning": "OEMUNI.DLL",
"Integer": "0",
"Field": {
"Type": "wide char",
"Offset": "28756",
"Length": "20"
}
},
{
"Label": "Machine",
"Meaning": "Intel 386",
"Integer": "332",
"Field": {
"Type": "uint16",
"Offset": "260",
"Length": "2"
}
},
{
"Label": "Base Address",
"Meaning": "0x5B8C0000",
"Integer": "1535901696",
"Field": {
"Type": "uint32",
"Offset": "308",
"Length": "4"
}
},
{
"Label": "Characteristics",
"Meaning": "File is executable, Line numbers stripped, Local symbols stripped, 32 bit word, DLL",
"Integer": "8462",
"Field": {
"Type": "uint16",
"Offset": "278",
"Length": "2"
}
},
{
"Label": "DLL Characteristics",
"Meaning": "",
"Integer": "0",
"Field": {
"Type": "uint16",
"Offset": "348",
"Length": "2"
}
},
{
"Label": "Subsystem",
"Meaning": "Windows Console",
"Integer": "3",
"Field": {
"Type": "uint16",
"Offset": "348",
"Length": "2"
}
},
{
"Label": "Compiled",
"Meaning": "2001-08-18T05:35:41Z",
"Integer": "998112941",
"Field": {
"Type": "uint32",
"Offset": "264",
"Length": "4"
}
},
{
"Label": "File Alignment",
"Meaning": "512",
"Integer": "512",
"Field": {
"Type": "uint32",
"Offset": "316",
"Length": "4"
}
},
{
"Label": "Code Size",
"Meaning": "20480",
"Integer": "20480",
"Field": {
"Type": "uint32",
"Offset": "284",
"Length": "4"
}
},
{
"Label": "Initialized Data Size",
"Meaning": "901120",
"Integer": "901120",
"Field": {
"Type": "uint32",
"Offset": "288",
"Length": "4"
}
},
{
"Label": "Uninitialized Data Size",
"Meaning": "0",
"Integer": "0",
"Field": {
"Type": "uint32",
"Offset": "292",
"Length": "4"
}
},
{
"Label": "Major OS Version",
"Meaning": "5",
"Integer": "5",
"Field": {
"Type": "uint16",
"Offset": "320",
"Length": "2"
}
},
{
"Label": "Minor OS Version",
"Meaning": "1",
"Integer": "1",
"Field": {
"Type": "uint16",
"Offset": "322",
"Length": "2"
}
},
{
"Label": "Major Image Version",
"Meaning": "5",
"Integer": "5",
"Field": {
"Type": "uint16",
"Offset": "324",
"Length": "2"
}
},
{
"Label": "Minor Image Version",
"Meaning": "1",
"Integer": "1",
"Field": {
"Type": "uint16",
"Offset": "326",
"Length": "2"
}
},
{
"Label": "Major Subsystem Version",
"Meaning": "4",
"Integer": "4",
"Field": {
"Type": "uint16",
"Offset": "328",
"Length": "2"
}
},
{
"Label": "Minor Subsystem Version",
"Meaning": "10",
"Integer": "10",
"Field": {
"Type": "uint16",
"Offset": "330",
"Length": "2"
}
},
{
"Label": "Rich 01 Component ID",
"Meaning": "0019",
"Integer": "25",
"Field": {
"Type": "uint16",
"Offset": "146",
"Length": "2"
}
},
{
"Label": "Rich 01 Component Version",
"Meaning": "9043",
"Integer": "9043",
"Field": {
"Type": "uint16",
"Offset": "144",
"Length": "2"
}
},
{
"Label": "Rich 01 Times",
"Meaning": "6",
"Integer": "6",
"Field": {
"Type": "uint32",
"Offset": "148",
"Length": "4"
}
},
{
"Label": "Rich 02 Component ID",
"Meaning": "001C",
"Integer": "28",
"Field": {
"Type": "uint16",
"Offset": "154",
"Length": "2"
}
},
{
"Label": "Rich 02 Component Version",
"Meaning": "9037",
"Integer": "9037",
"Field": {
"Type": "uint16",
"Offset": "152",
"Length": "2"
}
},
{
"Label": "Rich 02 Times",
"Meaning": "1",
"Integer": "1",
"Field": {
"Type": "uint32",
"Offset": "156",
"Length": "4"
}
},
{
"Label": "Rich 03 Component ID",
"Meaning": "000E",
"Integer": "14",
"Field": {
"Type": "uint16",
"Offset": "162",
"Length": "2"
}
},
{
"Label": "Rich 03 Component Version",
"Meaning": "7299",
"Integer": "7299",
"Field": {
"Type": "uint16",
"Offset": "160",
"Length": "2"
}
},
{
"Label": "Rich 03 Times",
"Meaning": "2",
"Integer": "2",
"Field": {
"Type": "uint32",
"Offset": "164",
"Length": "4"
}
},
{
"Label": "Content MD5",
"Meaning": "902e45a45fa18a365ebdea18d21d03b4",
"Integer": "0",
"Field": {
"Type": "byte",
"Offset": "0",
"Length": "33280"
}
}
]
Detail Records
The file details record contains the data items from the file format. Each record contains the location in the file where the data came from as well as the meaning of the field translated to something a human can understand.
JSON Fields
Label
This is the name of the record. It is generally expected that this will be non-technical name.
Meaning
This field interprets the data to make it more understandable.
For example, dates can be represented many different ways in a file.
The Meaning field will contain the time decoded into something a human can understand.
Integer
If the underlying data was an integer, this field will contain the raw value.
Field
This describes the location and format of the record. It will contain three sub-fields.
Type
This describes the format of the raw data. It will map to one of the data type identifiers.
Offset
The offset in bytes from the beginning of the file where this field began.
Length
The number of bytes in the field.
Sample
Let's take apart a record from our sample:
{
"Label": "Machine",
"Meaning": "Intel 386",
"Integer": "332",
"Field": {
"Type": "uint16",
"Offset": "260",
"Length": "2"
}
}
Truxton read 2 bytes beginning with the 260th byte in the file and interpreted those bytes as a little endian sixteen-bit unsigned integer with a value of 332. This integer value in this field of the file matches the defined constant IMAGE_FILE_MACHINE_I386. Truxton translated that into something a little more palatable for a human, "Intel 386"
