Chapter 8 Review

When you carve a graphics file, recovering the image depends on which of the following skills? a. Recovering the image from a tape backup b. Recognizing the pattern of the data content c. Recognizing the pattern of the file header content d. Recognizing the pattern of a corrupt file

Recognizing the pattern of the file header count. Explain how to identify an unknown graphics file format that your digital forensics tool doesn't recognize

When recovering a file with ProDiscover, your first objective is to recover cluster values. True or False?

True

Only one file format can compress graphics files. True or False?

False

Explain how to identify an unknown graphics file format that your digital forensics tool doesn't recognize.

learn about file formats and file extensions

Which of the following is true about JPEG and TIF files? a. They have identical values for the first 2 bytes of their file headers. b. They have different values for the first 2 bytes of their file headers. c. They differ from other graphics files because their file headers contain more bits. d. They differ from other graphics files because their file headers contain fewer bits.

-Have different values for the first 2 bytes of their file headers

What methods are used for digital watermarking? (Choose all that apply.) a. Implanted subroutines that link to a central Web server automatically when the watermarked file is accessed b. Invisible modification of the LSBs in the file c. Layering visible symbols on top of the image d. Using a hex editor to alter the image data

-Invisible modification of the LSBs in the file, -Layering visible symbols on top of the image

Some clues left on a drive that might indicate steganography include which of the following? (Choose all that apply.) a. Multiple copies of a graphics file b. Graphics files with the same name but different file sizes c. Steganography programs in the suspect's All Programs list d. Graphics files with different timestamps

-multiple copies of a graphics file -graphics files with the same name but different sizes -graphic files with different file stamps

Digital pictures use data compression to accomplish which of the following goals? (Choose all that apply.) a. Save space on a hard drive. b. Provide a crisp and clear image. c. Eliminate redundant data. d. Produce a file that can be e-mailed or posted on the Internet

-save space on a hard drive -produce a file that can be e-mailed or posted on the Internet

Graphics files stored on a computer can't be recovered after they are deleted. True or False?

False

When investigating graphics files, you should convert them into one standard format. True or False?

False

A JPEG file uses which type of compression? a. WinZip b. Lossy c. Lzip d. Lossless

Lossy

In JPEG files, what's the starting offset position for the JFIF label? a. Offset 0 b. Offset 2 c. Offset 6 d. Offset 4

Offset 6

What methods do steganography programs use to hide data in graphics files? (Choose all that apply.) a. Insertion b. Substitution c. Masking d. Carving

-Insertion - Substitution

The process of converting raw images to another format is called which of the following? a. Data conversion b. Transmogrification c. Transfiguring d. Demosaicing

Demosaicing

A JPEG file is an example of a vector graphic. True or False

False

Copyright laws don't apply to Web sites. True or False?

False

Bitmap (.bmp) files use which of the following types of compression? a. WinZip b. Lossy c. Lzip d. Lossles

Lossless

Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files. True or False?

True

When viewing a file header, you need to include hexadecimal information to view the image. True or False?

True

What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data?

lossless