312-49 Question #541: Real Exam Question with Answer & Explanation

The correct answer is C: jpeg. File signatures (also called magic bytes or magic numbers) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. The hex signature FF D8 FF is the universal JPEG/JFIF marker. The fourth byte further qualifies the subtype:

Submitted by zhang_li· Apr 18, 2026Disk Forensics

Question

Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image?

Options

Agif
Bbmp
Cjpeg
Dpng

Explanation

File signatures (also called magic bytes or magic numbers) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. The hex signature FF D8 FF is the universal JPEG/JFIF marker. The fourth byte further qualifies the subtype: FF D8 FF E1 specifically identifies a JPEG file containing EXIF (Exchangeable Image File Format) metadata, commonly produced by digital cameras. For reference: PNG files begin with 89 50 4E 47, GIF files with 47 49 46 38, and BMP files with 42 4D. Recognizing these signatures is fundamental to file carving and forensic image analysis.

Topics

#File Signatures#Magic Numbers#Image File Formats#Digital Forensics Tools

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions