Recovering Graphics Files

Flashcards for reviewing graphics file forensics.

Bitmap images

Collection of dots.

Vector graphics

Based on mathematical instructions.

Metafile graphics

Combination of bitmap and vector.

Bitmap images

Grids of individual pixels.

Raster images

Collections of pixels, stored in rows, better for printing.

Screen resolution

Determines the amount of detail.

Vector Graphics

Uses lines instead of dots to store only the calculations for drawing lines and shapes; smaller than bitmap files and preserve quality when enlarged.

Metafile graphics

Combine raster and vector graphics, sharing advantages and disadvantages of both types; bitmap part loses quality when enlarged.

Raw file format

Digital negative, found on higher-end digital cameras; maintains the best picture quality.

Demosaicing

The process of converting raw picture data to another format.

Exchangeable Image File Format (Exif)

Commonly used to store digital pictures, developed as a standard for storing metadata in JPEG and TIF files; investigators can learn more about the type of digital camera and the environment in which pictures were taken.

Data compression

Coding data from a larger to a smaller form by getting rid of the redundancy.

Lossless compression

Reduces file size without removing data, based on Huffman or Lempel-Ziv-Welch coding, used for documentation purposes.

Lossy compression

Permanently discards bits of information, determines what data to discard based on vectors in the graphics file, used for analytical purposes.

Steganography

The practice of concealing a file, message, image, or video within another file, message, image, or video.

Steganography in Graphics Files

Hides information inside image files, two major forms: insertion and substitution; hidden data is not displayed when viewing host file in its associated program; you need to analyze the data structure carefully.

Substitution

Replaces bits of the host file with other bits of data, usually change the last two LSBs (least significant bit); detected with steganalysis tools (a.k.a - steg tools).

Steganalysis

The science of detecting the presence of hidden data in cover media files; it night need cryptanalysis.