Lecture 4: Recovering Graphics Files Notes

Overview of Graphics File Formats

  • Graphics files include:

  • Digital photographs

  • Line art

  • 3D images

  • Text data converted to images

  • Scanned replicas of printed images

Types of Graphics File Formats

  • Bitmap Images: (collection of dots)

    • Represented as a grid of individual pixels.

    • Best for printing.

    • Quality determined by screen resolution and software drivers.

  • Raster Images: (also collection of pixels)

    • pixels are stored in rows

    • better for printing

  • Vector Graphics: (lines instead of dots)

    • Use mathematical instructions instead of pixels.

    • Store calculations for drawing lines and shapes.

    • Maintain quality when enlarged, smaller file sizes than bitmaps.

    • Examples: CorelDRAW, Adobe Illustrator.

  • Metafile Graphics:

    • Combination of raster and vector graphics

    • Example: A scanned photo (bitmap) with vector illustrations like text or arrows.

    • Bitmap quality decreases when enlarged.

  • Image Quality

    • screen resolution - determines amount of detail

    • software contributes to image quality (graphics drivers / cards)

    • number of color bits used per pixel

Common Bitmap and Vector Formats

  • Standard Graphic File Formats:

    • .png (Portable Network Graphic)

    • .gif (Graphics Interchange Format)

    • .jpeg/.jpg (Joint Photographic Experts Group)

    • .tiff/.tif (Tagged Image File Format)

    • .bmp (Windows Bitmap)

  • Standard Vector File Formats:

    • .hpgl (Hewlett Packard Graphics Language)

    • .dxf (Autocad)

  • Nonstandard Graphic File Formats:

    • .tga (Targa)

    • .rtl (Raster Transfer Language)

    • .psd (Adobe Photoshop)

    • .ai (Adobe Illustrator)

    • .svg (Scalable Vector Graphics)

    • .pcx (Paintbrush)

Understanding Digital Photograph File Formats

  • witnesses or suspects can create their own digital photos

  • Examining raw file format:

    • raw file format is referred to as a digital negative

    • found on higher end digital cameras

    • sensors in the camera record pixels on the cameras memory card

    • raw format maintains the best picture quality

    • its is proprietary which can be a disadvantage as not all viewers can display these formats

    • the process of converting raw picture data to another format is called demosaicing

  • Examining the Exchanging Image file format (Exif):

    • commonly used to store digital pictures

    • developed by JEITA as a standard for storing metadata in JPEG and TIF files

    • this format collects metadata meaning investigators can learn more about the type of digital device and the environment in which photos were taken

    • requires special programs to view Exif JPEG files metadata including

      • exif reader, irfanVIew, or Magnetic Forensics AXIOM

    • exif file stores metadata at the beginning of the file

    • tools such as Autopsy and Exif reader allow for extraction of metadata as evidence for your case

Data Compression Techniques

process of coding data from a larger form to a smaller form.

  • Most graphics formats compress data with lossless or lossy compression.

    • GIF, JPEG

  • Lossless Compression:

    • Reduces file size without losing data.

    • Used formats: GIFs, PNGs.

    • Utilities: WinZip, PKZip.

  • Lossy Compression:

    • Permanently removes data (bits of information).

    • Common in JPEG formats.

    • Vector quantization (VQ) determines what data to eliminate.

    • Utility: Lzip

Recovering Graphics Files

  • Locating and Recovering Graphic Files

  • Digital Forensic Tools

    • Tools for digital forensics can recover files from slack and fragmented areas.

    • Compare file headers with good samples to find patterns during recovery.

    • Use header info to create a baselines analysis

  • Reconstruct Image Files

    • identify data patterns and modified headers

  • Identifying Graphics File Fragments:

    • craving and salvaging

      • recovering and type of file fragments

      • DF tools can carve from file slack and free space

      • help identify image files fragments and put them together

  • Repairing Damaged Headers:

    • when examining recovered fragments you may find data that appears to be a header. If the header is damaged or overwritten, you must reconstruct the header to make it readable by:

      • comparing the hexadecimal values of known graphic file formats (JPEG File) with the pattern of your file header you found.

  • File Fragments:

    • Each graphic file has a unique header (e.g., JPEG files start with FFD8).

    • Damaged headers must be reconstructed using hex values derived from known formats.

Rebuilding File headers

  • try opening the file with an image viewer first

    • if the image isn’t displayed, you may have to inspect and correct the header values manually.

  • Steps:

    • recover more pieces of file if needed

    • examine file header

      • compare with good header samples

      • manually insert correct hexadecimal values

    • test corrected file

Reconstructing File Fragments

  • locate the noncontiguous clusters that make up a deleted file

  • steps

    • locate and export all clusters of the fragmented file

    • determine the starting and ending cluster numbers for each fragmented group of sectors

    • copy each fragmented group of sectors in their correct sequence to a recovery file

    • rebuild the files header to make it readable

    • add a .txt extension to all copied sectors

Navigating Unknown Formats

  • Use search engines and resources like FileFormat.info for explanations of formats.

  • Digital forensics tools help in analyzing metadata and file types.

Understanding Steganography In Graphics Files

Technique to hide information inside image files with the following methods:

  • Insertion:

    • Data hidden without altering the host file's visible structure.

      • you need to analyze the data structure carefully e.g. webpage

  • Substitution:

    • Replace bits of the host file with bits of data, often in the last two significant bits (LSB).

    • Tools for detection include steganalysis software which can flag files with unusual properties.

  • clues to look for Steganography:

    • duplicate files with different hash values

    • steganography programs installed on the suspects drive

Copyright Considerations

  • Always check copyright laws when dealing with graphics.

  • Understanding fair use: noncommercial use of copyrighted material without payment.

Summary of Key Points

  • Graphics file formats determine image quality and storage specifics.

  • Understanding compression types aids in file recovery.

  • Knowledge of header values and formats is crucial for digital forensics.

  • Steganography considerations are important for identifying hidden information.