Computer Forensics Ch. 8

Some clues left on a drive that might indicate stenography include what?

Multiple copies of an image file, Image files , S-Tools and Stegowatch

Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files. True or false?

true

When viewing a file header, you need to include hexadecimal information to view image. True or False?

True

Explain how to identify an unknown graphics files format that your digital forensics tool doesn't recognize.

1. examine a copy of the file with a hexadecimal editor to find the hex code for the first several bytes of the file.

Graphic files stored on a computer can't be recovered after they are deleted. True or False?

False

Only one file format can compress graphics file. True or False?

False

When investigating graphics files, you should convert them into one standard format. True or false?

False

A JPEG files uses what type of compression?

Lossy

A JPEG file is an example of a vector graphic. True or False?

False

Copyright laws don't apply to web sites. True or false?

False

What is true about JPEG and TIF files?

Have different values for the first 2 bytes of their file headers

What methods do stenography programs use to hide data in graphics files?

Insertion, Substitution

What methods are used for digital watermarking?

Invisible modification of the LSBs in the file, Layering visible symbols on top of the image

Bitmap (.bmp) files use which of the following types of compression?

Lossless

What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data?

Lossless Compression

When recovering a file with ProDiscover, your first objective is to recover cluster values. True or False?

True

The process of converting raw images to another format is called what?

demosaicing

In JPEG files, what's the starting offset position for the JFIF label?

offset 6

When you carve a graphics file recovering the image depends on what?

recognizing the pattern of the header content

Digital pictures use data compression to accomplish which of the following goals?

save space on a hard drive, produce a file that can be e-mailed or posted on the internet