Security and privacy

Note

FileScope is in development. The engine, the filescope command line and the FileScope.exe desktop app are implemented and tested internally; there is no public download or release yet. This page describes the current implementation.

At a glance

What FileScope reads

For one file per run, in this order:

1. The file’s metadata (size, dates, attributes, file system, link information), from the open file before any content is read.
2. At most the first 64 KiB to identify the format from its content. Nothing is decompressed, decoded or followed.
3. The whole file, once, to calculate SHA-256, unless you skip hashing.
4. The Authenticode signature, verified by Windows (WinVerifyTrust) through the same open file: first an embedded signature, then the security catalogs. Revocation checking is off and certificate URLs are retrieved from the local cache only, so verification never uses the network.
5. The Zone.Identifier stream (Mark-of-the-Web), opened relative to the inspected file so a file swapped during inspection cannot lend it another file’s mark.

While it reads, FileScope keeps other programs from writing to the file, so every result describes one version of it. If another program already had the file open for writing, FileScope says so, compares the file before and after, and withholds the hash and signature verdict if anything changed.

Windows may update the file’s last-access time when content is read, as it does for any program that reads a file. FileScope reports the time captured before it read anything.

What FileScope refuses or handles carefully

• Devices, pipes, raw volumes and alternate data streams are refused before anything touches the path. Only files on drives, volumes and file shares are inspected.
• Ambiguous names. A path through a folder whose name ends in a dot or a space is refused, because other programs would open a different file for the same text.
• Links and junctions are followed the way any program opening the path would follow them, one component at a time, and both the link and its target are reported.
• Online-only cloud files (OneDrive and similar) are not read unless you allow it, because reading makes the provider download them.
• A file on a network share is read over that share like any other program would, which contacts that server with your Windows credentials.

Hostile file names and text

File names, signer names, download addresses and text from inside a file can contain control characters, right-to-left overrides and invisible characters that make them display as something else. FileScope shows such characters as U+XXXX codes in every report, so a name like photo + U+202E + gpj.exe cannot pose as photoexe.jpg, and text from a file cannot send escape sequences to your terminal. JSON output contains the raw values, escaped only as JSON requires; scripts that display them should take the same care.

What it stores

The command line stores nothing. The desktop app writes only %LOCALAPPDATA%\FileScope\settings.json (theme, zoom and window placement) and, after an unexpected error, error.log next to it. It never records which files you inspected, and it does not write that folder through a link or junction.

What a result does and does not mean

FileScope reports what a file is and what Windows can verify about it. It never says a file is safe, clean or malicious:

• Not signed means Windows cannot tell who published the file. Many legitimate programs are unsigned.
• Valid means the signature matches the content and chains to a certificate this computer trusts. It identifies the signer; it says nothing about what the program does. Only a valid signature is shown as the publisher; any other signer appears as “claims to be”, unverified.
• No Mark-of-the-Web does not mean the file is local or trustworthy: USB sticks, cloud sync and many download tools never add one.
• An extension mismatch is reported only for a high-confidence identification. It is a reason to look closer, not proof of harm.

To check a file by hand with the same reasoning, read Inspect a suspicious file with built-in Windows tools.

Known limits

• Content appended after the first 64 KiB (an installer’s payload, a ZIP attached to a program) is not identified.
• A certificate revoked after Windows last cached revocation data is not detected.
• One file per run; folders and archive contents are not inspected.
• Formats without a reliable signature are reported as unrecognised, and text formats are never compared with the extension.

Signing and reporting

There is no public release yet, so nothing can be downloaded or verified. FileScope follows the same release pipeline as every Utility Forge application: a clean build from a tagged commit, published SHA-256 checksums, immutable release paths, a signed or unsigned status stated before download and the owner’s approval of the exact files. No code-signing certificate exists; free signing is being evaluated, and an unsigned FileScope release would first need its own policy decision. The security page explains how releases will be verified, what Windows shows for signed and unsigned files and how to report a vulnerability. Please do not report security issues in public.