I'm currently doing research on cracking encrypted, compressed files (specifically: uif, zip, 7z, dmg). Looking at all the utilities out there, it seems the time it takes to crack something is greatly reduced when a better idea of password length/character set is known (this is obvious to me from prior experience in brute forcing/dictionary attacks). Is there a way to forensically analyze the encrypted compressed files themselves to get more information on the password, the hash it uses, etc in order to optimize cracking?
Theories I've thought of but need to know feasibility/tools needed: forensic markings in the assembler/binary, figuring out hashing mechanism to allow rainbow tables, etc.