Recovering Graphics Files (Module 8 Review) - [Computer Forensics]

A JPEG file is an example of a vector graphic.

False

What methods do steganography programs use to hide data in graphics files?

1. Insertion 2. Substitution

Some clues left on a drive that might indicate steganography include which of the following?

1. Multiple copies of a graphics file 2. Steganography programs in the suspect's All Programs list 3. Graphics files with the same name but different file sizes

Graphics files stored on a computer can't be recovered after they are deleted.

False

Only one file format can compress graphics files.

False

When investigating graphics files, you should convert them into one standard format.

False

A JPEG file uses which type of compression?

Lossy

All of the following are valid graphic file formats except: a. Microsoft image file (.mif) b. Graphic Interchange Format (.gif), c. Joint Photographic Experts Group (.jpeg) d. Windows Bitmap (.bmp)

Microsoft image file (.mif)

In JPEG files, what's the starting offset position for the JFIF label?

Offset 6

Which of the following would NOT be considered metadata of an electronic photograph? a. Photographer b. Time of capture c. Camera type d. Shutter speed

Photographer

Vector graphics are mathematical instructions that define all of the following except: a. Lines b. Pixels c. Geometric shapes d. Curves

Pixels

When you carve a graphics file, recovering the image depends on which of the following skills?

Recognizing the pattern of the file header content

Digital pictures use data compression to accomplish which of the following goals?

Save space on a hard drive.

The process of converting raw images to another format is called which of the following?

Demosaicing

Copyright laws don't apply to Web sites.

False

What methods are used for digital watermarking?

Invisible modification of the LSBs in the file

Bitmap (.bmp) files use which of the following types of compression?

Lossless

What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data?

Lossless

Which of the following methods can be used to hide data by using a host file to cover the contents?

Steganography

Which of the following is true about JPEG and TIF files?

They have different values for the first 2 bytes of their file headers.

Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files.

True

To identify an unknown graphics file format you need to examine a copy of the unknown file with a hexadecimal editor to find the hex code for the first several bytes of the file.

True

When viewing a file header, you need to include hexadecimal information to view the image.

True