How to get file type from encrypted file?

Question

How do I get the file type using C# from an encrypted file (ie file.enc )?

Encryption Method: Shift Cipher Z ₂₅₆

Shift Cipher Encryption:

Y _i = (X _i + k) % 256

X _i = (Y _i - k) % 256

Where:

X _i , i = 1 : n, is the input in plain bytes.

Y _i , i = 1 : n, is the output cipher bytes.

k is the shift key which is a secret byte between 1 and 255.

If I have to decrypt the file first, how could I decrypt it without using exhaustive search to find the shift key ?

I'm not talking about getting .enc as I can already easily do that. I'm not able to determine how the file was before encryption such as .doc , .xls , .pdf , .jpg , or .wav file types.

What I have tried:

byte[] byteArray = File.ReadAllBytes(openFileDialog1.FileName);

// Mean
double mean = 0;

for (int i = 0; i < byteArray.Length; i++)
{
    mean += byteArray[i];
}

mean = mean / byteArray.Length;
txtMean.Text = mean.ToString("#.000");

// Median
byteArray.ToList().Sort();
int median = byteArray[(int)Math.Floor((decimal)(byteArray.Length / 2))];
txtMedian.Text = median.ToString();

// Mode
var groups = byteArray.GroupBy(g => g);
int maxCount = groups.Max(g => g.Count());
int mode = groups.First(g => g.Count() == maxCount).Key;
txtMode.Text = mode.ToString();

// Standard Deviation
double standardDeviation = byteArray.Select(value => (value - mean) * (value - mean)).Sum();
standardDeviation = Math.Sqrt(standardDeviation / byteArray.Length);
txtStandardDeviation.Text = standardDeviation.ToString("#.000");

// Entropy (I don't know how to get this part.)
int entropy = 0;
txtEntropy.Text = entropy.ToString();

So, from this you can see I take the file, read all bytes of the file and find the mean , median , mode , standard deviation , and entropy values.

By the way, I don't know how to find the entropy value for the file, is there some formula for this or maybe a C# built-in method? I have searched, but found nothing.

I thought using the mode value would be able to determine the file type, but rather it only determines .pdf files as .pdf files have a mode of 48.

.doc , .xls , .docx , .xlsx , .jpg , and .wav files all give me a mode of 0.

I have also tried reading the bytes using the following page(s):

ASCII Character Codes Chart 1 - https://msdn.microsoft.com/en-us/library/60ecse8t(v=vs.80).aspx ASCII Character Codes Chart 2 - https://msdn.microsoft.com/en-us/library/9hxt0028(v=vs.80).aspx

using this code:

string str = Encoding.ASCII.GetString(byteArray).Substring(0, 256);

but it just returns gibberish in which I am unable to determine the difference in file types.

Answer 1

If it is a ' Caesar Shift ', then you just run down the alphabet, trying each possible shift, there are only 25 of them.

NBCM CM UH YRUGJFY
nbcm cm uh yrugjfy
ocdn dn vi zsvhkgz
pdeo eo wj atwilha
qefp fp xk buxjmib
rfgq gq yl cvyknjc
sghr hr zm dwzlokd
this is an example
uijt jt bo fybnqmf
vjku ku cp gzcorng
wklv lv dq hadpsoh
xlmw mw er ibeqtpi
ymnx nx fs jcfruqj
znoy oy gt kdgsvrk
aopz pz hu lehtwsl
bpqa qa iv mfiuxtm
cqrb rb jw ngjvyun
drsc sc kx ohkwzvo
estd td ly pilxawp
ftue ue mz qjmybxq
guvf vf na rknzcyr
hvwg wg ob sloadzs
iwxh xh pc tmpbeat
jxyi yi qd unqcfbu
kyzj zj re vordgcv
lzak ak sf wpsehdw
mabl bl tg xqtfiex
nbcm cm uh yrugjfy