312-49V11 · Question #128
John, a forensic examiner, has been tasked with analyzing an evidence image file acquired from a suspect machine. While conducting his investigation, he discovered a file that appeared to be…
The correct answer is D. PNG. This question aligns with CHFI v11 objectives under Operating System Forensics and File Type and Encoding Analysis. In digital forensics, file signature analysis--also known as magic number analysis--is a critical technique used to identify the true file type regardless of its…
Question
John, a forensic examiner, has been tasked with analyzing an evidence image file acquired from a suspect machine. While conducting his investigation, he discovered a file that appeared to be suspicious. He opened the file in a Hex Editor and found the hex value of the file starting with "89 50 4E". Based on his analysis, which file type does this hex value correspond to?
Options
- APDF
- BJPEG
- CBMP
- DPNG
How the community answered
(33 responses)- A12% (4)
- B3% (1)
- C3% (1)
- D82% (27)
Explanation
This question aligns with CHFI v11 objectives under Operating System Forensics and File Type and Encoding Analysis. In digital forensics, file signature analysis--also known as magic number analysis--is a critical technique used to identify the true file type regardless of its extension. Attackers often rename or disguise files to evade detection, making hex-level inspection essential during forensic examinations. Each file format begins with a unique hexadecimal header that identifies its structure. The hex value "89 50 4E 47" corresponds to the ASCII representation of PNG, which is the standard file signature for Portable Network Graphics (PNG) files. CHFI v11 specifically emphasizes the use of hex editors to analyze file headers and detect file extension mismatches during investigations.
Topics
Community Discussion
No community discussion yet for this question.