312-49 · Question #427
One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc…
The correct answer is B. the file header. To verify the true file type regardless of its extension, an investigator can examine the file header, which contains specific 'magic numbers' identifying the file format.
Question
One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?
Options
- Athe File Allocation Table
- Bthe file header
- Cthe file footer
- Dthe sector map
How the community answered
(44 responses)- A5% (2)
- B93% (41)
- D2% (1)
Why each option
To verify the true file type regardless of its extension, an investigator can examine the file header, which contains specific 'magic numbers' identifying the file format.
The File Allocation Table (FAT) stores metadata about file locations on a disk, not the internal content format identifiers.
The file header contains specific 'magic numbers' or file signatures that are unique to different file formats and identify the actual type of content stored within the file. By analyzing these bytes at the beginning of the file, an investigator can determine its true format, even if the file extension has been deliberately altered.
The file footer might contain some format-specific information, but the most crucial and consistent identifier for the file type is typically found in the header.
The sector map describes how logical sectors are mapped to physical sectors on a disk, not the content type of individual files.
Concept tested: File format identification, file headers (magic numbers)
Source: https://learn.microsoft.com/en-us/windows/win32/stg/file-signatures
Topics
Community Discussion
No community discussion yet for this question.