Computer Forensics Chapter 8

Which of the following is true about JPEG and TIF files? a. They have different values for the first 2 bytes of their file headers. b. They differ from other graphics files because their file headers contain more bits. c. They have identical values for the first 2 bytes of their file headers. d. They differ from other graphics files because their file headers contain fewer bits.

a. They have different values for the first 2 bytes of their file headers.

The process of converting raw images to another format is called which of the following? a. demosaicing b. transmogrification c. transfiguring d. data conversion

a. demosaicing

Bitmap (.bmp) files use which of the following types of compression? a. lossless b. lossy c. WinZip d. Lzip

a. lossless

Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files. a. true b. false

a. true

To identify an unknown graphics file format you need to examine a copy of the unknown file with a hexadecimal editor to find the hex code for the first several bytes of the file. a. true b. false

a. true

When viewing a file header, you need to include hexadecimal information to view the image. a. true b. false

a. true

Digital pictures use data compression to accomplish which of the following goals? a. Eliminate redundant data. b. Save space on a hard drive. c. Provide a crisp and clear image. d. All of the above

b. Save space on a hard drive.

A JPEG file is an example of a vector graphic. a. true b. false

b. false

Copyright laws don't apply to Web sites. a. true b. false

b. false

Graphics files stored on a computer can't be recovered after they are deleted. a. true b. false

b. false

Only one file format can compress graphics files. a. true b. false

b. false

When investigating graphics files, you should convert them into one standard format. a. true b. false

b. false

What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data? a. lossy b. lossless c. vector quantization d. recursive

b. lossless

What methods do steganography programs use to hide data in graphics files? a. Insertion b. Substitution c. Either of the above d. None of the above

c. Either of the above

What methods are used for digital watermarking? a. using hex editor to alter image data b. Implanted subroutines that link to a central Web server automatically when the watermarked file is accessed c. Invisible modification of the LSBs in the file d. Nothing; this is what you'd expect to see.

c. Invisible modification of the LSBs in the file

In JPEG files, what's the starting offset position for the JFIF label? a. Offset 4 b. offset 0 c. offset 6 d. offset 2

c. offset 6

Some clues left on a drive that might indicate steganography include which of the following? a. Graphics files with the same name but different file sizes b. Steganography programs in the suspect's All Programs list c. Multiple copies of a graphics file d. All of the above

d. All of the above

A JPEG file uses which type of compression? a. Lzip b. Lossless c. WinZip d. Lossy

d. Lossy

When you carve a graphics file, recovering the image depends on which of the following skills? a. Recovering the image from a tape backup b. Recognizing the pattern of a corrupt file c. Recognizing the pattern of the data content d. Recognizing the pattern of the file header content

d. Recognizing the pattern of the file header content