Question

I have a database stored in memory of different files headers. I would like to test the signature of a given file for example a .jpg to those signatures in the database.

Consider that scenario, the signature of the file to be tested is FFD8FFE0, but in the database, there is only a partially matched signature of FFD8FF, and some times, the database has also a signature of FFD8, but to a different type but to the same file format.
How do I correctly retrieve the correct matched signature of the tested file ?

I wrote the following function but it doesn’t work in all file formats.

 public static boolean searchSignature(File file, List<FileSignature> db) throws FileNotFoundException, IOException {

        byte[] buffer = new byte[MAX_SIGNATURE_SIZE];
        InputStream in = new FileInputStream(file);
        int n = in.read(buffer, 0, MAX_SIGNATURE_SIZE);
        String hex  = toHex(buffer);
        boolean b = true;

        // for each signature in the database, compare it with file's siganture
        for (FileSignature fs : db) {
             if (!fs.getSignature().contains(hex)) {
                b = false;

            }
        }
        return b;
    }

Answer 1

Your condition should be

if ( hex.startsWith( fs.getSignature() ) 

Since hex is longer than the signature from your DB.

If you have both FFD8FF and FFD8 you can’t differentiate between the longer and shorter signature.