Forensic Analysis of .rbfx Files and Compression Streams

📅 2025-10-23 — Session: Forensic Analysis of .rbfx Files and Compression Streams

🕒 03:45–04:00
🏷️ Labels: Forensics, Compression, Python, Data Analysis, Binary Parsing
📂 Project: Dev

Session Goal

The primary objective of this session was to conduct a forensic analysis of .rbfx files to detect and analyze embedded compressed streams using various algorithms.

Key Activities

• Forensic Scan of .rbfx Files: Implemented a script to detect compressed streams using LZMA, gzip, zlib, and LZ4 algorithms. Functions for byte entropy calculation and decompression were included.
• File Header Signature Analysis: Analyzed file headers to identify unique signatures, focusing on the ‘PAR E*’ sequence.
• Custom Container Parsing: Developed a heuristic for parsing custom containers, scanning headers for little-endian 32-bit counts and offsets.
• Compression Magic Detection: Created a script to locate compression magic numbers in binary files.
• Hex and ASCII Dump Function: Provided a function for generating structured hex and ASCII dumps for file inspection.
• Data Recovery Strategy: Outlined a strategy for analyzing 10-bit integer streams and recovering data from .rbfx structures.

Achievements

• Successfully implemented multiple scripts and functions for forensic analysis and file inspection.
• Developed a comprehensive strategy for data recovery and analysis of custom binary formats.

Pending Tasks

• Further exploration of formal learning resources for development and tool creation in data compression and binary analysis.
• Enhancement of skills in reverse engineering proprietary formats through recommended reading.