andrewrathbun / sighunter

A C# (.NET 6) tool to compare the file signature of files recursively and inform the user of matches and mismatches

SigHunter

A DFIR-focused tool to help identify files masquerading as a different file type!

Sample Command

SigHunter.exe -d C:\temp\Path\To\Scan\Recursively -o C:\temp\Output\Folder

Output

Using the FileSignatures.cs dictionary of file extensions and their corresponding expected file signatures, SigHunter will output three CSV files:

• matched_files.csv - files that match the file extension with the expected file signature
• mismatched_files.csv - files that DO NOT match the file extension with the expected file signature
• unmatched_files.csv - files that do not have a file extension entry in the tool's dictionary

Feedback

There are a lot of improvements I want to make to this tool, but for now, it's functional and fast! Please report any issues here and I'll work on them as I have time!

sighunter's Issues

Add switch to output hashes of files being scanned to CSV output

Check for case sensitivity in FileSignatures dictionary

.EXE is showing as mismatch, but .exe is showing as a match, despite the same file extension

Add stopwatch

Add switches for match only/mismatch only

Add test data for validation

Add logic to ignore .txt files unless they match the dictionary key:value pair

flat text files without the BOM signature (EF-BB-BF) are going to generate lots of false positives

add command line parser library

Add JSON output

Add better messaging for output CSVs

Include row count, byte size, full filepath, etc

Add validation logic for `-d` and `-o`

Make sure -o isn't a file path, rather, a folder path

Handle EXE, DLL, etc better

COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS		Windows/DOS executable file(See The MZ EXE File Format page for the structure of an EXE file,with coverage of NE, TLINK, PE, self-extracting archives, and more.)Note: MZ are the initals of Mark Zbikowski, designer of the DOS executable file format.

COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS Windows/DOS executable file (See [The MZ EXE File Format](http://www.fileformat.info/format/exe/corion-mz.htm) page for the structure of an EXE file, with coverage of NE, TLINK, PE, self-extracting archives, and more.) Note: MZ are the initals of Mark Zbikowski, designer of the DOS executable file format.

https://www.garykessler.net/library/file_sigs.html

try not to label these as mismatches, rather, if the file extension matches one of these, then it's a match

Add Serilog