Chapter 08: Recovering Graphics Files

Present a list of categories covered under copyright laws in the U.S.

Copyrightable works include the following categories: 1. literary works; 2. musical works, including any accompanying words; 3. dramatic works, including any accompanying music; 4. pantomimes and choreographic works; 5. pictorial, graphic, and sculptural works; 6. motion pictures and other audiovisual works; 7. sound recordings; 8. architectural works.

A graphics program creates and saves one of three types of image files: bitmap, vector, or XIF. a. True b. False

False

All TIF files start at position zero (offset 0 is the first byte of a file) with hexadecimal 49 49 3B. a. True b. False

False

Operating systems do not have tools for recovering image files. a. True b. False

False

Steganography cannot be used with file formats other than image files. a. True b. False

False

The Internet is the best source for learning more about file formats and their extensions. a. True b. False

True

The two major forms of steganography are insertion and substitution. a. True b. False

True

Explain how to use steganalysis tools.

You can use several different steganalysis tools (also called "steg tools") to detect, decode, and record hidden data, even in files that have been renamed to protect their contents. A steganalysis tool can also detect variations of an image. If a graphics file has been renamed, a steganalysis tool can identify the file format from the file header and indicate whether the file contains an image. Although steganalysis tools can help identify hidden data, steganography is generally difficult to detect. In fact, if steganography is done correctly, in most cases you can't detect the hidden data unless you can compare the altered file with the original file. Check to see whether the file size, image quality, or file extensions have changed. If so, you might be dealing with a steganography image.

Which header starts with hexadecimal 49 49 2A and has an offset of four bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 64 20 03? a. TIFF b. XIF c. JPEG d. GIF

b. XIF

Which type of compression compresses data permanently by discarding bits of information in the file? a. Redundant b. Lossy c. Huffman d. Lossless

b. Lossy

What type of laws should computer investigators be especially aware of when working with image files in order to avoid infringement violations? a. International b. Forensics c. Copyright d. Civil

c. Copyright

What is the process of converting raw picture data to another format called? a. Abstracting b. Rastering c. Demosaicing d. Rendering

c. Demosaicing

If a graphics file cannot be opened in an image viewer, what should the next step be? a. Examining the file's extension b. Examining the file's name c. Examining the file's header data d. Examining the file's size

c. Examining the file's header data

Which data-hiding technique replaces bits of the host file with other bits of data? a. Insertion b. Replacement c. Substitution d. Pixelation

c. Substitution

What kinds of images are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes? a. Bitmap images b. Metafile graphics c. Vector graphics d. Line-art images

c. Vector graphics

Write a brief history of steganography.

Steganography has been used since ancient times. Greek rulers used this technique to send covert messages to diplomats and troops via messengers. To hide messages, rulers shaved their messengers' heads and tattooed messages on their scalps. After the messengers's hair grew enough to cover the message, they left for their destinations, where they shaved their heads so that recipients could read the message. This method was a clever way to send and retrieve encrypted information, but it was inefficient because the messengers' hair took a long time to grow back, and only a limited amount of space was available to write messages. However, it enabled the Greeks to send secret messages until their enemies discovered this early form of steganography and began intercepting messengers.

Give a brief overview of copyright laws pertaining to graphics within and outside the U.S.

The U.S.Copyright Office Web site defines precisely how copyright laws pertain to graphics (see www.copyright.gov for information on the 1976 Copyright Act). Copyright laws as they pertain to the Internet, however, aren't as clear. For example, a server in another country might host a Web site, which could mean it's regulated by copyright laws in that country. Because each country has its own copyright laws, enforcement can be difficult. Contrary to what some might believe, there's no international copyright law.

Bitmap images are collections of dots, or pixels, in a grid format that form a graphic. a. True b. False

True

If a graphics file is fragmented across areas on a disk, you must recover all the fragments before re-creating the file. a. True b. False

True

Under copyright laws, maps and architectural plans may be registered as pictorial, graphic, and sculptural works. a. True b. False

True

With many computer forensics tools, you can open files with external viewers. a. True b. False

True

Which uppercase letter has a hexadecimal value 41? a. "A" b. "C" c. "G" d. "Z"

a. "A"

How may computer programs be registered under copyright laws? a. As literary works b. As motion pictures c. As architectural works d. As audiovisual works

a. As literary works

Which term refers to a data-hiding technique that uses host files to cover the contents of a secret message? a. Steganography b. Steganalysis c. Graphie d. Steganos

a. Steganography

What is the simplest way to access a file header? a. Use a hexadecimal editor b. Use an image editor c. Use a disk editor d. Use a text editor

a. Use a hexadecimal editor

Which images store graphics information as grids of pixels? a. Bitmap b. Raster c. Vector d. Metafile

a. Bitmap

What term refers to recovering fragments of a file? a. Carving b. Slacking c. Saving d. Rebuilding

a. Carving

In which format are most digital photographs stored? a. EXIF b. TIFF c. PNG d. GIF

a. EXIF

What technique has been used to protect copyrighted material by inserting digital watermarks into a file? a. Encryption b. Steganography c. Compression d. Archiving

b. Steganography

What tools are used to create, modify, and save bitmap, vector, and metafile graphics? a. Graphics viewers b. Image readers c. Image viewers d. Graphics editors

d. Graphics editors

Which data-hiding technique places data from the secret file into the host file without displaying the secret data when the host file is viewed in its associated program? a. Replacement b. Pixelation c. Substitution d. Insertion

d. Insertion

What is another term for steganalysis tools? a. Image editors b. Image tools c. Hexadecimal editors d. Steg tools

d. Steg tools

Which JFIF format has a hexadecimal value of FFD8 FFE0 in the first four bytes? a. EPS b. BMP c. GIF d. JPEG

d. JPEG

. From which file format is the image format XIF derived? a. GIF b. JPEG c. BMP d. TIF

d. TIF

How does the number of colors a monitor displays affects image quality?

A setting that affects image quality is the number of colors the monitor displays. Graphics files can have different amounts of color per pixel, but each file must support colors with bits of space. The following list shows the number of bits per colored pixel: • 1 bit = 2 colors • 4 bits = 16 colors • 8 bits = 256 colors • 16 bits = 65,536 colors • 24 bits = 16,777,216 colors • 32 bits = 4,294,967,296 colors Bitmap and raster files use as much of the color palette as possible. However, when you save a bitmap or raster file, the resolution and color might change, depending on the colors in the original file and whether the file format supports these colors.

Briefly describe fair use.

A short direct quote for news reporting or critiques is considered fair use, and the material's originator or owner doesn't have to be paid. Material used for noncommercial and educational purposes also falls under the fair use guideline. These distinctions can get complicated, however. For example, an instructor copying parts of a book to use as handouts in a class setting is operating within the fair use guideline. On the other hand, if the instructor sends the book to a printer to copy and pays the printer, a copyright violation has occurred because a commercial printer was paid to copy the book, even though the copies were to be used for educational purposes.

Describe how to hide information on an 8-bit bitmap image file using substitution steganography

For example, if you use an 8-bit graphics file, each pixel is represented by 8 bits of data containing information about the color each pixel displays onscreen. The bits are prioritized from left to right, such as 11101100. The first bit on the left is the most significant bit (MSB), and the last bit on the right is the least significant bit (LSB). As the names suggest, changing the MSB affects the pixel display more than changing the LSB does. Furthermore, you can usually change only the last two LSBs in an image without producing a noticeable change in the shade of color the pixel displays. ​ For example, if your secret message is converted to binary form to equal 01101100 and you want to embed this secret message into a picture, you alter the last 2bits of four pixels. You break the binary form into sections of two, as in 01 10 11 00, and insert the bits into the last 2 bits of each pixel.

Explain how lossless compression relates to image file formats.

Lossless compression techniques reduce file size without removing data. When you uncompress a file that uses lossless compression, you restore all its information. GIF and Portable Network Graphics (PNG) file formats reduce file size with lossless compression, which saves file space by using mathematical formulas to represent data in a file. These formulas generally use one of two algorithms: Huffman or Lempel-Ziv-Welch (LZW) coding. Each algorithm uses a code to represent redundant bits of data. For example, if a graphics file contains a large red area, the algorithm can set 1 byte to red and set another byte to specify 200 red bytes instead of having to store 200 red bytes. Therefore, only 2 bytes are used.

Match each item with a statement below a.Pixels b.Hex Workshop c.Adobe Illustrator d.Raster image e.JPEG f.PNG g.GIMP h.Resolution i.Metafile graphics j.Data compression 1) Drawing program that creates vector files 2) Gnome graphics editor 3) Determines the amount of detail that is displayed 4) Combinations of bitmap and vector images 5) Short for "picture elements" 6) Graphics file format that uses lossless compression 7) Graphics file format that uses lossy compression 8) A disk editor tool 9) collection of pixels stored in rows to make images easy to print 10) Process of coding of data from a larger form to a smaller form

Match each item with a statement below a.Pixels b.Hex Workshop c.Adobe Illustrator d.Raster image e.JPEG f.PNG g.GIMP h.Resolution i.Metafile graphics j.Data compression 1) Drawing program that creates vector files - c 2) Gnome graphics editor - g 3) Determines the amount of detail that is displayed - h 4) Combinations of bitmap and vector images - i 5) Short for "picture elements" - a 6) Graphics file format that uses lossless compression - f 7) Graphics file format that uses lossy compression - e 8) A disk editor tool - b 9) collection of pixels stored in rows to make images easy to print - d 10) Process of coding of data from a larger form to a smaller form - j

Briefly describe the Exchangeable Image File (EXIF) format.

Most digital photographs are stored in the Exchangeable Image File (Exif) format. The Japan Electronics and Information Technology Industries Association (JEITA) developed it as a standard for storing metadata in JPEG and TIF files. When a digital photo is taken, information about the device (such as model, make, and serial number) and settings (such as shutter speed, focal length, resolution, date, and time) are stored in the graphics file. Most digital devices store graphics files as Exif JPEG files.

How does vector quantization (VQ) compress data?

One form of lossy compression, vector quantization (VQ), uses complex algorithms to determine what data to discard based on vectors in the graphics file. In simple terms,VQ discards bits in much the same way rounding off decimal values discards numbers.