Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process…

The correct answer is A. ff d8 ff. File signatures (magic bytes) are the first few bytes of a file that identify its format. The hex signature 'FF D8 FF' is the magic number for JPEG/JPG image files. The other signatures correspond to different file types: '25 50 44 46' translates to '%PDF' and is the signature…

Submitted by luis.pe· Apr 18, 2026Disk Forensics

Question

Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

Options

Aff d8 ff
B25 50 44 46
Cd0 0f 11 e0
D50 41 03 04

How the community answered

(55 responses)

A
93% (51)
B
2% (1)
C
4% (2)
D
2% (1)

Explanation

File signatures (magic bytes) are the first few bytes of a file that identify its format. The hex signature 'FF D8 FF' is the magic number for JPEG/JPG image files. The other signatures correspond to different file types: '25 50 44 46' translates to '%PDF' and is the signature for PDF files; 'D0 CF 11 E0' is the signature for Microsoft OLE2 Compound Document files (older DOC, XLS, PPT); and '50 4B 03 04' (similar to the listed value) is the signature for ZIP archives. Only 'FF D8 FF' identifies a JPEG image.

Topics

#File Signatures#Magic Numbers#Hexadecimal Analysis#Image Files

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice