One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc…

The correct answer is A. The file header. Every file type has a unique file header (also called a file signature or 'magic number') - a specific sequence of bytes at the beginning of the file that identifies its true format. For example, JPEG files always begin with the hex bytes FF D8 FF, regardless of the file…

Submitted by jaden.t· Apr 18, 2026Disk Forensics

Question

One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

Options

AThe file header
BThe File Allocation Table
CThe file footer
DThe sector map

How the community answered

(25 responses)

A
92% (23)
B
4% (1)
C
4% (1)

Explanation

Every file type has a unique file header (also called a file signature or 'magic number') - a specific sequence of bytes at the beginning of the file that identifies its true format. For example, JPEG files always begin with the hex bytes FF D8 FF, regardless of the file extension. An investigator can use a hex editor or forensic tools to read the file header and compare it against known file signature databases to determine the actual file type, exposing any attempt to hide files by renaming their extensions. The File Allocation Table tracks file locations on disk, file footers mark the end of some file types, and sector maps show disk layout - none reliably identify file types as accurately as file headers.

Topics

#File identification#File headers#File signatures#Data hiding

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice