Signature File Analysis Using The National Institute Standard Technology Method Base on Digital Forensic Concepts

Abstract

The number of crimes committed by utilizing advances in information technology such as information leakage, embezzlement of money in banks, credit card fraud, pornography, terrorism, drug trafficking and many more are definitely related to the name digital data. File signatures or magic numbers are one of the forensic science techniques that assist in processing this digital data. The method used in this research is the National Institute Standards Technology method to analyze the authenticity of digital data and the method of proof to obtain valid evidence during the identification process of data or file content. This research is presented in the form of an analysis of the use of signature files in investigations to determine the type of file in the case of leaking company information xyz, the research stage uses evidence handling procedures in the laboratory. Contributions made after conducting a series of case investigations using signature files have been successfully carried out using the Access Data FTK Imager application version 4.2.0 and WinHex version 18.6. Signature files can be used for case investigations in identifying and verifying file types so that files that have been modified can be restored and can be read by the operating system by checking file types through hexadecimal values in the header file (file prefix) that show the characteristics of each type file so that the file type can be found and the file can be read by the operating system.