Recovering Graphics Files

Recognizing a Graphics File

  • Graphic files contain digital photographs, line art, three-dimensional images, text data converted to images, and scanned replicas of printed pictures.
  • Three types of graphics files:
    • Bitmap images: collection of dots/pixels in a grid format
    • Vector graphics: based on mathematical instructions that define geometric shapes
    • Metafile graphics: combination of bitmap and vector
  • Types of programs:
    • Graphics editors
    • Image viewers: irfanview.com

Understanding Bitmap and Raster Images

  • Bitmap images:
    • Grids of individual pixels
  • Raster images:
    • Collections of pixels (picture elements)
    • Pixels are stored in rows
    • Better for printing
  • Image quality:
    • Screen resolution - determines the amount of detail displayed
    • Software contributes to image quality (drivers)
    • Number of color bits used per pixel

Understanding Vector Graphics

  • Characteristics of vector graphics:
    • Uses lines instead of dots
    • Store only the calculations for drawing lines and shapes
    • Smaller than bitmap files
    • Preserve quality when the image is enlarged
  • Examples: CorelDRAW, Adobe Illustrator

Understanding Metafile Graphics

  • Metafile graphics combine raster and vector graphics
    • Example: Scanned photo (bitmap) with text or arrows (vector)
  • Share advantages and disadvantages of both types
    • When enlarged, the bitmap part loses quality, but the vector-formatted area remains sharp

Understanding Graphics File Formats

  • Standard graphics file formats:
    • Standard bitmap file formats
      • Portable Network Graphic (.png)
      • Graphic Interchange Format (.gif)
      • Joint Photographic Experts Group (.jpeg, .jpg)
      • Tagged Image File Format (.tiff, .tif)
      • Window Bitmap (.bmp)
    • Standard vector file formats
      • Hewlett Packard Graphics Language (.hpgl)
      • AutoCAD (.dxf)

Understanding Graphics File Formats

  • Nonstandard graphics file formats:
    • Targa (.tga)
    • Raster Transfer Language (.rtl)
    • Adobe Photoshop (.psd) and Illustrator (.ai)
    • Freehand (.fh11)
    • Scalable Vector Graphics (.svg)
    • Paintbrush (.pcx)
  • Search the Web for software to manipulate unknown image formats: garykessler.net/library/file_sigs.html

Understanding Digital Photograph File Formats

  • Witnesses/suspects use digital cameras to produce photos in raw or Exif format
  • Raw file format
    • Sensors in the digital camera simply record pixels on the camera’s memory card
    • A camera performs no enhancement processing - hence the term “raw”
    • Raw format maintains the best picture quality
    • The biggest disadvantage is that it’s proprietary
    • Not all image viewers can display these formats
    • The process of converting raw picture data to another format (JPEG/TIF) is referred to as demosaicing

Understanding Digital Photograph File Formats

  • Exchangeable Image File (Exif) format stores digital pictures as a standard for storing metadata in JPEG and TIF files
    • Commonly used to
    • Developed by JEITA (Japan Electronics and Information Technology Industries Association: jeita.or.jp/english/)
  • Exif format collects metadata
    • Information about the device (such as model, make, and serial number) and settings (such as shutter speed, focal length, resolution, date, and time) are stored in the graphics file
    • Investigators can learn more about the type of digital device and the environment in which photos were taken: home.jeita.or.jp/tsc/std-pdf/CP3451C.pdf

Understanding Digital Photograph File Formats

  • Viewing an Exif JPEG file’s metadata requires special programs
    • Exif Reader, IrfanView, or Magnet Forensics AXIOM
  • Exif file stores metadata at the beginning of the file
  • With tools such as Autopsy and Exif Reader, you can extract metadata as evidence for your case

Exif Metadata Example

  • Example of Exif Metadata includes:
    • Make - ASUS
    • Model - Transformer TF101
    • Orientation - Top left
    • XResolution - 72
    • YResolution - 72
    • ResolutionUnit - Inch
    • Software -
    • DateTime - 2012:07:08 17:34:17
    • Artist -
    • YCbCrPositioning - Centered
    • Copyright -
    • ExifOffset - 261
    • ExposureTime - 1/10.0 seconds
    • FNumber - 0.00
    • ExposureProgram - Normal program
    • ISOSpeedRatings - 100
    • ExifVersion - 0220
    • DateTimeOriginal - 2012:07:08 17:34:17
    • DateTimeDigitized - 2012:07:08 17:34:17
    • ComponentsConfiguration - YCbCr
    • CompressedBitsPerPixel - 4 (bits/pixel)
    • ExposureBiasValue - 0.00
    • MaxApertureValue - F 1.00
    • SubjectDistance - 0.00/0.00 m
    • MeteringMode - Other
    • LightSource - Auto
    • Flash - Not fired
    • FocalLength - 3.40 mm
    • FlashPixVersion - 0100
    • ColorSpace - sRGB
    • ExifImageWidth - 2592
    • ExifImageHeight - 1944
    • InteroperabilityOffset - 833
    • FileSource - Other
    • CustomRendered - Normal process
    • ExposureMode - Auto
    • WhiteBalance - Auto
    • DigitalZoomRatio - 1 x
    • SceneCaptureType - Standard
    • ShutterSpeedValue - 1/10 seconds
    • ApertureValue - F 1.00
    • BrightnessValue - -3
    • UserComment – GPS information:
      • GPSVersionID - 2.2.0.0
      • GPSTimeStamp - 21 34 17
      • GPSDateStamp - 2012:07:08
    • Thumbnail:
      • ImageWidth - 20971520
      • ImageLength - 15728640
      • Orientation - 0
      • Compression - 6 (JPG)
      • JpegIFByteCount - 21234
      • JpegIFOffset - 1050

IrfanView Formats Overview

  • Lists various file formats supported by IrfanView, detailing whether the program can open and/or save in each format.
  • Formats include but are not limited to: AIF, ANI, AU, SND, AVI, WMV, ASF, B3D, BMP, DIB, CAM, CLP, CPT, CRW, CR2, CUR, DCM, ACR, IMA, DCX, DDS, DJVU, IW44, DPX, CIN, DXF, DWG, HPGL, CGM, ECW, EMF, EPS, PS, PDF, AI, EXR, FITS, FLI, FLC, FLIF, FPX, G3, GIF, HDP, WDP, HDR, HEIC, ICL, EXE, DLL, ICO, IFF, LBM, IMG, IMNG, JNG, JP2, JPC, J2K, JPG, JPEG, JPM, KDC, Mac PICT, QTIF, MED, MID, RMI, MOV, MP4, MP3, MPG, MPEG, MrSID, SID, DNG, EFF, NEF, MRW, ORF, RAF, DCR, SRF, ARW PEF, X3F, RW2, NRW, Minolta, Olympus, Fuji, Kodak, Sony, Pentax, Sigma, OGG, PBM, PCX, PCD, PDN, PGM, PNG, PPM, PSD, SVG, PSP, RAS, SUN, RA, RAW, RLE, SFF, SFW, SGI, RGB, RGBA, SWF, FLV, TGA, TIF, TIFF, TTF, TXT, ULS, JPEG-LS, WBMP, WEBP, WMF, WSQ, XBM, XCF, and XPM.

Understanding Digital Photograph File Formats

  • Comparison of Exif and JPEG files:
    • Exif picture file contrasted with a JPEG picture file.
    • Illustrates the differences in file header information.
  • JPEG file label types.
  • Differences in Exif and JPEG file header information is shown via offset addresses and values.

Understanding Digital Photograph File Formats

  • EOI (End Of Image) marker FFD9FFD9 is present in all JPEG files for proper termination.

Understanding Digital Photograph File Formats

  • Autopsy is used to display metadata from an Exif JPEG file.
  • From The Sleuth Kit istat Tool:
    • Directory Entry: 47535
    • Allocated
    • File Attributes: File, Archive
    • Size: 291877
    • Name: IMG_1345.jpg
    • Directory Entry Times:
      • Written: 2017-07-10 17:50:56 (PDT)
      • Accessed: 2017-07-10 00:00:00 (PDT)
      • Created: 2017-07-10 17:55:54 (PDT)
    • Sectors:
      • 10624 10625 10626 10627 10628 10629 10630 10631
      • 10632 10633 10634 10635 10636 10637 10638 10635
      • 10640 10641 10642 10643 10644 10645 10646 10647
      • 4 Results

Understanding Data Compression

  • Most graphics file formats compress their data, e.g., GIF and JPEG.
  • Others, like BMP, do not compress their data; use data compression tools for those formats.
  • Data compression:
    • Coding data from a larger to a smaller form
    • Types: Lossless compression and lossy compression

Lossless and Lossy Compression

  • Lossless compression:
    • Reduces file size without removing data
    • Based on Huffman or Lempel-Ziv-Welch (LZW) coding
    • GIF and PNG formats use lossless compression
    • Uses a code to represent redundant bits of data
    • Utilities: WinZip, PKZip, StuffIt, and FreeZip
  • Lossy compression:
    • Some discarded bits are redundant, but others are not
    • Vector quantization (VQ) determines what data to discard based on vectors in the graphics file
    • Utility: Lzip
    • The JPEG format uses lossy compression

Locating and Recovering Graphics Files

  • Examine all files found by forensics tools, even if they aren’t identified as graphics files.
  • OS graphics tools are time-consuming, and results are difficult to verify.
  • Always follow standard procedures to make sure your analysis is thorough.
  • Digital forensics tools:
    • Image headers
      • Compare with good header samples
      • Use header information to create a baseline analysis
    • Reconstruct fragmented image files
      • Identify data patterns and modified headers

Identifying Graphics File Fragments

  • Carving or salvaging:
    • Recovering any type of file fragments
  • Digital forensics tools:
    • Can carve from file slack and free space
    • Help identify image file fragments and put them together

Repairing Damaged Headers

  • When examining recovered fragments from files in slack or free space:
    • You might find data that appears to be a header
  • If header data is partially overwritten, you must reconstruct the header to make it readable.
    • By comparing the hexadecimal values of known graphics file formats with the pattern of the file header you found
    • Example: JPEG has the header hex value FFD8FFD8, followed by the label JFIF at offset 6

Searching for and Carving Data from Unallocated Space

  • Steps:
    • Planning your examination
    • Searching for and recovering digital photograph evidence
      • Use Autopsy for Windows to search for and extract (recover) possible evidence of JPEG files
      • False hits are referred to as false positives

Searching for and Carving Data from Unallocated Space

  • Autopsy is used to search for and extract data, presenting results such as source file, date created, device model and make, path, and file size.
  • Parsing Exif metadata in Autopsy is displayed.

Searching for and Carving Data from Unallocated Space

  • The results of searching for “fif”.

Searching for and Carving Data from Unallocated Space

  • The altered file header.
  • File header overwritten with zzzz.

Searching for and Carving Data from Unallocated Space

  • Viewing all sectors used by the gametour2.exe file.

Rebuilding File Headers

  • Before attempting to edit a recovered graphics file:
    • Try to open the file with an image viewer first
  • If the image isn’t displayed, you must inspect and correct the header values manually
  • Steps:
    • Recover more pieces of file if needed
    • Examine file header
      • Compare with a good header sample
      • Manually insert correct hexadecimal values

Rebuilding File Headers

  • Error message indicating a damaged or an altered graphics file.

Rebuilding File Headers

  • Recover1.jpg open in HxD.
  • Inserting correct hexadecimal values for a JPEG file.

Rebuilding File Headers

  • ASCII hexadecimal conversion table

Rebuilding File Headers

  • Fixed1.jpg open in an image viewer.

Reconstructing File Fragments

  • To perform this data-carving task:
    • Locate and export all clusters of the fragmented file
    • Determine starting/ending cluster numbers for each fragmented group of sectors
    • Copy each fragmented group of sectors in their correct sequence to a recovery file
    • Rebuild the file’s header to make it readable in a graphics viewer
    • Add a .txt extension on all the copied sectors

Identifying Unknown File Formats

  • Knowing the purpose of each format and how it stores data is part of the investigation process
  • The Internet is the best source
    • Search engines
    • Find explanations and viewers: fileformat.info/format/all.htm, extension.informer.com/, martinreddy.net/gfx/

Analyzing Graphics File Headers

  • Necessary when you find files your tools do not recognize (e.g. XIF)
  • Use a hexadecimal editor such as WinHex or HxD
    • Record hexadecimal values in the header and use them to define a file type
  • Example:
    • XIF file format is old; little information is available.
    • The first 3 bytes of an XIF file are the same as a TIF file
    • Build your own header search string

Analyzing Graphics File Headers

  • A TIF file open in WinHex
  • TIF file headers start with hexadecimal 49 49 2A, equivalent to ASCII II
  • Source: X-Ways AG, www.x-ways.net

Analyzing Graphics File Headers

  • A XIF file open in WinHex
  • ASCII equivalent shows the same beginning values as a TIF extension
  • Source: X-Ways AG, www.x-ways.net
  • fileformat.info/info/mimetype/image/vnd.xiff/index.htm vincent-net.com/luc/papers/99isdmdocumenttalk.pdf

Tools for Viewing Images

  • After recovering a graphics file:
    • Use an image viewer to open and view it
  • No one viewer program can read every file format
    • Having many different viewer programs is best
  • Most GUI forensics tools include image viewers that display common image formats
  • Be sure to analyze, identify, and inspect every unknown file on a drive

Understanding Steganography in Graphics Files

  • Steganography hides information inside image files
    • An ancient technique
  • Two major forms: insertion and substitution
  • Insertion
    • Hidden data is not displayed when viewing host file in its associated program
    • You need to analyze the data structure carefully
    • Example: Web page

Understanding Steganography in Graphics Files

  • The HTML code reveals hidden text
  • A simple Web page displayed in a Web browser

Understanding Steganography in Graphics Files

  • Substitution
    • Replaces bits of the host file with other bits of data
    • Usually change the last two LSBs (least significant bit)
    • Detected with steganalysis tools (aka - steg tools)
  • You should inspect all files for evidence of steganography
  • Clues to look for:
    • Duplicate files with different hash values
    • Steganography programs installed on the suspect’s drive
  • Original pixel Altered pixel
    • 1010 1010 1010 1001
    • 1001 1101 1001 1110
    • 1111 0000 1111 0011
    • 0011 1111 0011 1100
  • Bit breakdown of a secret message: 01 10 11 00

Understanding Steganography in Graphics Files

  • Original and altered images

Understanding Steganography in Graphics Files

  • A hidden message in the altered image

Using Steganalysis Tools

  • Use steg tools to detect, decode, and record hidden data
  • Detect variations of the graphic image
  • In most cases, hidden data cannot be detected unless you compare the altered file with the original file.
  • Check to see whether the file size, image quality, or file extensions have changed: sans.org/readingroom/whitepapers/stenganography/steganography-whats-real-risk-555

Understanding Copyright Issues with Graphics

  • Steganography has been used to protect copyrighted material by inserting digital watermarks into a file
  • Digital investigators need to be aware of copyright laws
  • Copyright laws for the Internet are not clear; there is no international copyright law
  • Check the U.S. Copyright Office
    • U.S. Copyright Office identifies what can and can’t be covered under copyright law in the U.S.
  • Material used for noncommercial and educational purposes also falls under the fair use guideline: copyright.gov

Understanding Copyright Issues with Graphics

  • The U.S. Copyright Office identifies what can and can’t be covered under copyright law in the United States
  • Copyrightable works include the following categories:
    1. Literary works (computer programs and most compilations)
    2. Musical works, including any accompanying words
    3. Dramatic works, including any accompanying music
    4. Pantomimes and choreographic works
    5. Pictorial, graphic, and sculptural works
    6. Motion pictures and other audiovisual works
    7. Sound recordings
    8. Architectural works
  • copyright.gov/circs/circ01.pdf