File analysis & content inspection

The mlab File Scan provides a structured and transparent analysis of files, focusing on metadata, cryptographic fingerprints, format-specific inspection and tool-driven results. Each file is analyzed using a set of tools adapted to its format and content.

How a file scan works

1. File metadata & fingerprints

Every file is first identified using cryptographic and structural fingerprints. These identifiers allow correlation across scans and external intelligence sources.

• SHA256 & MD5 – Cryptographic hashes for unique file identification and cross-platform correlation.
• SSDEEP – Fuzzy hashing for detecting similar or modified variants of the same file.
• Size & MIME – File size, extension and MIME type for format determination and validation.
• First seen – Timestamp and deterministic identity ensuring files are uniquely identifiable regardless of name or origin.

2. Format-aware analysis

Files are not analyzed using a single generic pipeline. Instead, mlab selects tools based on the detected file format. This ensures relevant results and avoids misleading or noisy outputs.

• Images & documents – Format-specific parsers for common document and media types.
• Static structure – Inspection of internal file structure without execution or detonation.
• Embedded data – Detection of hidden or embedded content within archives and binaries.
• Archives & binaries – Format-specific parsers adapted to each file type and structure.

Why format-aware matters

Generic file scanners

• Same tools for all files
• High noise
• Opaque verdicts
• Limited context

mlab file analysis

• Tool selection by format
• Structured outputs
• Explainable results
• Analyst-driven interpretation

3. Tool execution & results

Each compatible tool is executed independently and its raw output is preserved. Results are displayed per tool, allowing analysts to understand how conclusions are derived.

• One tab per tool – Each tool gets its own dedicated output section for clear separation.
• Raw & processed – Both raw and processed output available for complete transparency.
• No hidden aggregation – What you see is what the tools produced. No opaque scoring layer.
• Graceful failures – Partial tool failures are handled gracefully without corrupting other results.

Responsible usage & limitations

File analysis is performed in a controlled and defensive context. mlab does not execute files, does not attempt exploitation, and does not modify uploaded content.

• No execution – Uploaded files are never executed. Analysis is strictly static and read-only.
• Read-only analysis – Static inspection only. No modification of uploaded content at any stage.
• Defensive use – Designed for defensive security use-cases and legitimate analysis.
• User responsibility – Users are responsible for the content they upload and how they interpret results.