312-49 · Question #100
File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file
The correct answer is B. First 20 bytes. File signature analysis (also called 'magic number' analysis) identifies a file's true type by examining the file header - the initial bytes that contain a unique identifier specific to each file format. In digital forensics methodology (as defined in EC-Council CHFI…
Question
File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file
Options
- AFirst 10 bytes
- BFirst 20 bytes
- CFirst 30 bytes
- DFirst 40 bytes
How the community answered
(34 responses)- A3% (1)
- B88% (30)
- C3% (1)
- D6% (2)
Explanation
File signature analysis (also called 'magic number' analysis) identifies a file's true type by examining the file header - the initial bytes that contain a unique identifier specific to each file format. In digital forensics methodology (as defined in EC-Council CHFI curriculum), the first 20 bytes of a file are analyzed to determine its type and function, regardless of the file extension. This is critical because attackers or malware often disguise files by renaming their extensions. For example, a JPEG begins with FF D8 FF, a PDF with 25 50 44 46, and a PNG with 89 50 4E 47 0D 0A. Forensic tools compare these bytes against known signature databases to identify file types accurately.
Topics
Community Discussion
No community discussion yet for this question.