File Analysis

Definitions

1. The examination of a file's structure, metadata, contents, and behavior to determine whether it is malicious, sensitive, or otherwise noteworthy. File analysis can include hashes, headers, embedded macros, strings, signatures, and sandbox execution results.

   In plain English: Inspecting a file to understand what it is and whether it is dangerous.

   Example: "The phishing attachment looked harmless until file analysis revealed an obfuscated downloader macro."

Related Terms

• Access Log
• Data Recovery
• First Responder
• Forensic Toolkit
• Header Analysis
• Import Hash
• Incident Classification
• Incident Escalation
• Incident Severity
• Payload Analysis