FileScope

The problem

An attachment called report.pdf arrives, or a download finishes with a name you do not recognise. Windows decides how to open a file from the last part of its name, and File Explorer hides known extensions by default, so the name tells you what the file claims to be, not what it is. Finding out by hand means reading header bytes, calculating a hash, checking a signature and looking for an alternate data stream, with four different commands and no explanation of what the results mean. The guide Inspect a suspicious file with built-in Windows tools walks through exactly that.

What FileScope does

FileScope does those steps in one read-only pass and keeps every result next to what it means:

1. File. Size, dates, attributes and file system, captured from the open file before anything is read. Links and junctions are followed the way any program would follow them, and reported.
2. Content. The first 64 KiB are compared with known format signatures. A Windows program starts with MZ and a PE header; a PDF with %PDF; a Word document is a ZIP with a word/ folder inside. The match comes with its evidence and a confidence level, and only a high-confidence match can be reported as an extension mismatch.
3. Fingerprint. SHA-256 of the whole file, so you can compare it with the hash a publisher lists for its download.
4. Signature. Windows verifies the Authenticode signature, embedded or through a security catalog, against the certificates already on the computer. Revocation is not checked online.
5. Origin. The Mark-of-the-Web, if Windows recorded one, with the zone and, when the downloading program recorded them, the download and referrer addresses.

The command line prints the same sections:

FileScope 0.1.0. Read-only: the file was not run, changed or uploaded.

Content
  Type           Windows executable (PE)
  Confidence     high
  Extension      .exe (consistent)

Signature
  Status         Not signed
  Note           Verified offline against this computer's trusted certificates; revocation was not checked online.

Origin (Mark-of-the-Web)
  Status         Present: Internet zone (ZoneId 3)

Findings (4)
  [warning] Name ends in two extensions
            The name ends in ".pdf.exe". Windows uses only the last one, ".exe", and File Explorer hides known extensions by default, so the file may appear to be a ".pdf" file.

This is an abridged example from the command-line documentation; the full output also lists the file details and the SHA-256.

What a result does not mean

FileScope’s wording is tested against a few rules that also apply when you check a file by hand:

• Unsigned is not malware. Many legitimate programs are unsigned. It means Windows cannot tell who published the file.
• A valid signature is not safety. It says who signed the file and that it has not changed since. Signed malware exists, and a genuine signed program can be renamed to look like something else.
• No mark is not trust. Files copied from a USB stick, synchronised by a cloud client or downloaded with many command-line tools never get a Mark-of-the-Web.
• Nothing is invented. Anything FileScope could not determine is shown as not available, with the reason.

Current status

Part	State
Inspection engine and filescope command line	Implemented, tested on Windows CI
FileScope.exe desktop application	Implemented, tested internally
Portable ZIP packaging and verifier	Implemented; unsigned internal builds only
Release signing decision	Open: no certificate exists
Public release	None. Nothing is offered for download

Internal packages have been run only on Windows 11 x64.