file-forensics

name

file-forensics

description

Examine what a file claims about itself and what it actually contains — powered by Apache Tika. True content-based type detection (extensions lie), provenance claims (authors, dates, creating application), revision and tamper signals (PDF incremental updates, tracked changes, hidden slides, zip integrity), hidden and embedded content (attachments, macros), risk indicators (PDF JavaScript actions, encryption), and content digests. Evidence gathering, not verdicts: Tika reports what the file asserts and what parsing observed; it does not attribute authorship or validate signatures. Use for triaging suspicious files, provenance questions, e-discovery-style review, or "is this file what it claims to be."

Local override: $TIKA_SKILLS_LOCAL/file-forensics/LOCAL.md (default ~/.tika-skills), read after this file, wins on conflict.

File forensics with Apache Tika

What this can and cannot tell you. Tika cannot tell you who wrote a file. It can tell you — exhaustively — what the file claims about itself and what it actually contains, and those claims are the evidence: a dc:creator value is an assertion some software recorded, not an identity; a template-default author, an inconsistency between claimed dates, or a conspicuously missing field is as much a finding as a present one. Report what the file says; let the human draw conclusions.

The one rule for reading Tika's output: the key prefix tells you who is asserting each fact.

• tk:* — Tika's own parse-time observations, which the file cannot forge into place: magic-byte-detected type, embedded-item structure, encryption status, digests of the actual bytes.
• Everything else (dc:, pdf:docinfo:, extended-properties:, xmp:, ...) — the file's claims about itself, recorded by whatever software touched it, editable by anyone with a hex editor.