According to the CHFI v11 objectives under Digital Forensics Review and Anti-Forensics Techniques , attackers frequently use file extension manipulation as an anti-forensic technique to conceal malicious executables by renaming them with harmless-looking extensions such as .txt, .jpg, or .pdf. This tactic relies on the assumption that investigators or users will trust the file extension rather than verifying the file's true structure.
Autopsy , which is built on The Sleuth Kit (TSK) , provides a dedicated capability to detect file extension mismatches by analyzing file headers (magic numbers) and comparing them against the file's extension. If a file's internal signature does not match its extension, Autopsy flags it as suspicious, allowing investigators to identify hidden executables and recover their true file types. CHFI v11 explicitly highlights "Detecting File Extension Mismatch using Autopsy" as a key forensic technique for defeating anti-forensics.
OSForensics is primarily used for detecting data hiding techniques such as alternate data streams and overwritten metadata, while Timestomp is itself an anti-forensic tool used to manipulate timestamps.
StegoHunt focuses on steganography detection rather than file type validation.
The CHFI Exam Blueprint v4 emphasizes the importance of file type analysis and extension mismatch detection when investigating disguised malware, making Autopsy the most appropriate and exam-aligned tool in this scenario