> Fewer, but some, inspect files to deduce their type.

I don’t know. That’s extremely error-prone, often easy to fool, and in some cases hardly possible in the first place.

I think the only thing that’s really feasible is filtering out known bad things as some mild form of damage reduction.