File Forensics
package main
import (
"bufio"
"bytes"
"fmt"
"log"
"os"
)
// Automate error checking
func CE(x error) {
if x != nil {
log.Fatal(x)
}
}
func VerifyZipSig(k string) {
sig := `\x4b\x03\x04` // ZIP / Archive signature (0x4b,0x03, 0x04)
fmt.Printf("[%s]---[%s] Is being checked for a ZIP signature \n", "Debug", sig)
f, x := os.Open(k) // Open file
CE(x) // Check for error
defer f.Close() // Close the file when the block of code is done executing
buffer := bufio.NewReader(f) // create a new reader
stat, _ := f.Stat() // stat the file to grab the files size
for l := int64(0); l < stat.Size(); l++ { // itterate over the size
b, x := buffer.ReadByte() // read the byte
CE(x) // check for an error
if b == '\x50' { // check if the byte is 0x50 ( if the first byte is '\x50' before performing the more expensive buffer.Peek(3) operation, the code can quickly identify that a potential ZIP signature might exist in the file. This check helps to reduce unnecessary calls to buffer.Peek(3) and improve the efficiency of the overall search process. )
BS := make([]byte, 3) // Create the storage and buffer for the signature
BS, x = buffer.Peek(3)
CE(x) // Check error
if bytes.Equal(BS, []byte{'\x4b', '\x03', '\x04'}) {
fmt.Println("File [ ", k, " ] Contains a ZIP file")
} // Check and make sure that the ZIP signature accutally exists
}
}
}
// Main programatic entry point
func main() {
if len(os.Args) == 0 { // os arguments
fmt.Printf("Usage: %s image_file...", os.Args[0])
} else {
for _, f := range os.Args[1:] { // get all files from the argument list 'go run main.go file1.png file2.png file3.jpg ....'
VerifyZipSig(f) // call function
}
}
}Last updated