Security Ripcord


File Content Histograms

The following information is meant to document the histogram representations of characters typically found in different file types.   Please let me know if there are any other files that you think should be added to those represented here.  Each image is proceeded with of the name of the file graphed and the results of the Linux file command.

The following scripts were used to generate these images.

  • file_histograms.py – this script can be run on Windows or Linux as long as you have the proper requirements.  This script requires MatPlotLib and was built on a Windows XP system using Python(x,y).  Usage: python file_histograms.py file <optional title>
  • Windows EXE – this is a zipped file that contains an executable that was create using PY2EXE.  This executable needs to be run from the command line.  This should be self contained although there are a few Windows System DLLs that could not be included and must be present on your system.  One disadvantage of using this vice the python script is that not all of the Window options (Zoom, Save, etc) are available when viewing a graph.  Usage: dist\file_histograms.exe file <optional title>

gif_hist.gif:            GIF image data, version 89a, 500 x 332

jpeg_hist.jpg:           JPEG image data, JFIF standard 1.02

Jpeg Histogram

marines_hymn.mp3:        Audio file with ID3 version 23.0 tag, MP3 encoding

MP3 Histogram

ms_word.doc:             Microsoft Office Document

MS Word Histogram

ms_word.pdf:             PDF document, version 1.4

PDF Histogram

ms_word.txt:             Unicode text, UTF-8

Text Histogram

pics.tar.bz2:            bzip2 compressed data, block size = 900k

BZip2 Histogram

pics.tar.gz:             gzip compressed data, was “3cqz2a.tar”, from Unix, last modified: Sun Dec 21 14:39:46 2008

Gzip Histogram

pics.zip:                Zip archive data, at least v1.0 to extract

Zip Histogram

pics.zip.gpg:            data

GPG Histogram

RvBre_Trailer_HiRes.mp4: ISO Media, MPEG v4 system, version 2

MP4 Histogram

RvBre_Trailer_HiRes.wmv: Microsoft ASF

WMV Histogram

SuperScan4.exe:          MS-DOS executable PE  for MS Windows (GUI) Intel 80386 32-bit, UPX compressed

EXE Histogram

tiff_hist.tiff:          TIFF image data, little-endian

TIFF Histogram

Truecrypt_file:          data

Truecrypt Histogram

wipe:                    ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.6.1, dynamically linked (uses shared libs), stripped

ELF Histogram

Go forth and do good things,

Don C. Weber