DF CHAP 8

Introduction to Computer Forensics Chapter 8 – Recovering Graphics Files (Chapter 10 in 4th Edition)

1. Main Differences Between Bitmap Graphics and Vector Graphics

  • Bitmap Graphics

    • Also known as raster graphics.

    • Composed of pixels, each pixel representing a specific color.

    • Quality dependent on resolution; higher resolution means more detail, but larger file size.

    • Common formats: JPEG, PNG, BMP, and GIF.

  • Vector Graphics

    • Comprised of paths defined by mathematical equations.

    • Resolution-independent: can be resized without loss of quality.

    • Smaller file size compared to bitmap graphics.

    • Common formats: SVG, AI (Adobe Illustrator), and EPS.

2. Common Standard Graphic File Formats and Viewing Tools

  • Common Standard Graphic File Formats

    • JPEG (.jpg, .jpeg): Supports lossy compression; widely used for photographs.

    • PNG (.png): Supports lossless compression; allows for transparency.

    • BMP (.bmp): Uncompressed bitmap format; large file size.

    • GIF (.gif): Supports simple animations; limited to 256 colors.

    • TIFF (.tiff): High-quality format; often used in professional environments.

  • Common Tools for Viewing Standard Graphic File Formats

    • Image viewers: Windows Photo Viewer, Mac Preview.

    • Editing software: Adobe Photoshop, GIMP, Paint.NET.

    • Web browsers which natively support viewing graphic formats online.

3. Viewing Nonstandard Graphic File Formats

  • Nonstandard graphic file formats are those that cannot be opened or viewed in conventional forensic tools.

  • Methods to view these files include:

    • Identifying file extension and researching the specific software required to open it.

    • Hex editors can be used to view the binary format and determine the structure, allowing potential recovery.

    • Converting them to standard formats using specialized software or conversion tools.

4. Lossless vs. Lossy Graphics Compression

  • Lossless Compression

    • No data is lost during compression; the original image can be perfectly reconstructed.

    • Examples: PNG, TIFF.

  • Lossy Compression

    • Some data is lost during compression; results in reduced file size, often at the expense of quality.

    • Examples: JPEG, WEBP.

5. Salvaging Partially Deleted Graphic Files by Modifying the File Header

  • When a graphic file is partially deleted, the file header may still be intact, providing necessary metadata.

  • Steps to modify the file header include:

    • Locate the file header within the file system using a hex editor.

    • Restore or modify header information to match the expected format for the file type (e.g., changing size attributes or data offsets).

    • Attempt to recover or extract pixel data based on the corrected header information, as some pixel data may still be recoverable in the storage medium.

6. Steganography

  • Definition: Steganography is the practice of hiding messages within other non-secret text or data.

  • First Recorded Use: The first recorded use of steganography dates back to Ancient Greece, where messages were hidden in the wax of tablets for secret communication.

7. Two Major Forms of Steganography

  • Digital Steganography

    • Involves hiding data in digital mediums such as images, audio files, or video files.

    • Techniques include manipulating the least significant bits (LSB) of image files to embed secret messages.

  • Traditional Steganography

    • Consists of techniques such as microdots or altering physical objects to embed hidden messages.

    • Used before the digital age, often involving ink and paper or physical items to encode information.

8. Steganalysis Tool

  • Definition: A steganalysis tool is a software application designed to detect and analyze steganography.

  • Purpose: It aims to find hidden information within files and assess the presence of steganographic content, typically by evaluating statistical patterns or discrepancies in file data.