Guide to Computer Forensics

and Investigations
Sixth Edition

Chapter 8
Recovering Graphics Files

1
 Objectives

• Describe types of graphics file formats

• Explain types of data compression
• Explain how to locate and recover graphics files
• Describe how to identify unknown file formats
• Explain copyright issues with graphics

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
2
2
protected website for classroom use.
 Recognizing a Graphics File

• Graphic files contain digital photographs, line art, three-dimensional images,

text data converted to images, and scanned replicas of printed pictures
• Bitmap images: collection of dots
• Vector graphics: based on mathematical instructions
• Metafile graphics: combination of bitmap and vector
• Types of programs
• Graphics editors
• Image viewers

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
3
3
protected website for classroom use.
 Understanding Bitmap and Raster Images

• Bitmap images
• Grids of individual pixels
• Raster images - also collections of pixels
• Pixels are stored in rows
• Better for printing
• Image quality
• Screen resolution - determines amount of detail
• Software contributes to image quality (drivers)
• Number of color bits used per pixel

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
4
4
protected website for classroom use.
 Understanding Vector Graphics

• Characteristics of vector graphics

• Uses lines instead of dots
• Store only the calculations for drawing lines and shapes
• Smaller than bitmap files
• Preserve quality when image is enlarged
• CorelDRAW, Adobe Illustrator

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
5
5
protected website for classroom use.
 Understanding Metafile Graphics

• Metafile graphics combine raster and vector graphics

• Example
• Scanned photo (bitmap) with text or arrows (vector)
• Share advantages and disadvantages of both types
• When enlarged, bitmap part loses quality

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
6
6
protected website for classroom use.
 Understanding Graphics File Formats (1 of
2)
• Standard graphics file formats
• Standard bitmap file formats
- Portable Network Graphic (.png)
- Graphic Interchange Format (.gif)
- Joint Photographic Experts Group (.jpeg, .jpg)
- Tagged Image File Format (.tiff, .tif)
- Window Bitmap (.bmp)
• Standard vector file formats
- Hewlett Packard Graphics Language (.hpgl)
- Autocad (.dxf)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
7
7
protected website for classroom use.
 Understanding Graphics File Formats (2 of
2)
• Nonstandard graphics file formats
• Targa (.tga)
• Raster Transfer Language (.rtl)
• Adobe Photoshop (.psd) and Illustrator (.ai)
• Freehand (.fh11)
• Scalable Vector Graphics (.svg)
• Paintbrush (.pcx)
• Search the Web for software to manipulate unknown image formats

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
8
8
protected website for classroom use.
 Understanding Digital Photograph File
Formats (1 of 8)
• Witnesses or suspects can create their own digital photos
• Examining the raw file format
• Raw file format
- Referred to as a digital negative
- Typically found on many higher-end digital cameras
• Sensors in the digital camera simply record pixels on the camera’s memory card
• Raw format maintains the best picture quality

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
9
9
protected website for classroom use.
 Understanding Digital Photograph File
Formats (2 of 8)
• Examining the raw file format (cont’d)
• The biggest disadvantage is that it’s proprietary
- And not all image viewers can display these formats
• The process of converting raw picture data to another format is referred to as
demosaicing
• Examining the Exchangeable Image File format
• Exchangeable Image File (Exif) format
- Commonly used to store digital pictures
- Developed by JEITA as a standard for storing metadata in JPEG and TIF files

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
10
10
protected website for classroom use.
 Understanding Digital Photograph File
Formats (3 of 8)
• Examining the Exchangeable Image File format (cont’d)
• Exif format collects metadata
- Investigators can learn more about the type of digital device and the environment in
which photos were taken
• Viewing an Exif JPEG file’s metadata requires special programs
- Exif Reader, IrfanView, or Magnet Forensics AXIOM
• Exif file stores metadata at the beginning of the file

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
11
11
protected website for classroom use.
Understanding Digital Photograph File
Formats (4 of 8)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
12
12
protected website for classroom use.
Understanding Digital Photograph File
Formats (5 of 8)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
13
13
protected website for classroom use.
Understanding Digital Photograph File
Formats (6 of 8)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
14
14
protected website for classroom use.
 Understanding Digital Photograph File
Formats (7 of 8)
• Examining the Exchangeable Image File format (cont’d)
• With tools such as Autopsy and Exif Reader
- You can extract metadata as evidence for your case

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
15
15
protected website for classroom use.
Understanding Digital Photograph File
Formats (8 of 8)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
16
16
protected website for classroom use.
 Understanding Data Compression

• Most graphics file formats compress their data

• GIF and JPEG
• Others, like BMP, do not compress their data
• Use data compression tools for those formats
• Data compression
• Coding data from a larger to a smaller form
• Types
- Lossless compression and lossy compression

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
17
17
protected website for classroom use.
 Lossless and Lossy Compression

• Lossless compression
• Reduces file size without removing data
• Based on Huffman or Lempel-Ziv-Welch coding
- For redundant bits of data
• Utilities: WinZip, PKZip, StuffIt, and FreeZip
• Lossy compression
• Permanently discards bits of information
• Vector quantization (VQ)
- Determines what data to discard based on vectors in the graphics file
• Utility: Lzip

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
18
18
protected website for classroom use.
 Locating and Recovering Graphics Files

• Operating system tools

• Time-consuming
• Results are difficult to verify
• Digital forensics tools
• Image headers
- Compare them with good header samples
- Use header information to create a baseline analysis
• Reconstruct fragmented image files
- Identify data patterns and modified headers

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
19
19
protected website for classroom use.
 Identifying Graphics File Fragments

• Carving or salvaging
• Recovering any type of file fragments
• Digital forensics tools
• Can carve from file slack and free space
• Help identify image files fragments and put them together

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
20
20
protected website for classroom use.
 Repairing Damaged Headers (1 of 4)

• When examining recovered fragments from files in slack or free space

• You might find data that appears to be a header
• If header data is partially overwritten, you must reconstruct the header to make
it readable
• By comparing the hexadecimal values of known graphics file formats with the pattern
of the file header, you found

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
21
21
protected website for classroom use.
 Repairing Damaged Headers (2 of 4)

• Each graphics file has a unique header value

• Example:
• A JPEG file has the hexadecimal header value FFD8, followed by the label JFIF for a
standard JPEG or Exif file at offset 6
• Exercise:
• Investigate a possible intellectual property theft by a new employee of Superior
Bicycles, Inc.

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
22
22
protected website for classroom use.
Repairing Damaged Headers (3 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
23
23
protected website for classroom use.
Repairing Damaged Headers (4 of 4)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
24
24
protected website for classroom use.
 Searching for and Carving Data from
Unallocated Space (1 of 6)
• Steps
• Planning your examination
• Searching for and recovering digital photograph evidence
- Use Autopsy for Windows to search for and extract (recover) possible evidence of
JPEG files
- False hits are referred to as false positives

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
25
25
protected website for classroom use.
Searching for and Carving Data from
Unallocated Space (2 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
26
26
protected website for classroom use.
Searching for and Carving Data from
Unallocated Space (3 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
27
27
protected website for classroom use.
Searching for and Carving Data from
Unallocated Space (4 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
28
28
protected website for classroom use.
Searching for and Carving Data from
Unallocated Space (5 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
29
29
protected website for classroom use.
Searching for and Carving Data from
Unallocated Space (6 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
30
30
protected website for classroom use.
 Rebuilding File Headers (1 of 6)

• Before attempting to edit a recovered graphics file

• Try to open the file with an image viewer first
• If the image isn’t displayed, you have to inspect and correct the header values
manually
• Steps
• Recover more pieces of file if needed
• Examine file header
- Compare with a good header sample
- Manually insert correct hexadecimal values
• Test corrected file

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
31
31
protected website for classroom use.
Rebuilding File Headers (2 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
32
32
protected website for classroom use.
Rebuilding File Headers (3 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
33
33
protected website for classroom use.
Rebuilding File Headers (4 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
34
34
protected website for classroom use.
Rebuilding File Headers (5 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
35
35
protected website for classroom use.
Rebuilding File Headers (6 of 6)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
36
36
protected website for classroom use.
 Reconstructing File Fragments
• Locate the noncontiguous clusters that make up a deleted file
• Steps
• Locate and export all clusters of the fragmented file
• Determine the starting and ending cluster numbers for each fragmented group of
sectors
• Copy each fragmented group of sectors in their correct sequence to a recovery file
• Rebuild the file’s header to make it readable in a graphics viewer
• Add a .txt extension on all the copied sectors

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
37
37
protected website for classroom use.
 Identifying Unknown File Formats

• Knowing the purpose of each format and how it stores data is part of the
investigation process
• The Internet is the best source
• Search engines
• Find explanations and viewers
• Popular Web sites
• FileFormat.info
• Extension Informer
• The Graphics File Formats Page

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
38
38
protected website for classroom use.
 Analyzing Graphics File Headers (1 of 3)

• Necessary when you find files your tools do not recognize

• Use a hexadecimal editor such as WinHex
• Record hexadecimal values in the header and use them to define a file type
• Example:
• XIF file format is old, little information is available
• The first 3 bytes of an XIF file are the same as a TIF file
• Build your own header search string

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
39
39
protected website for classroom use.
Analyzing Graphics File Headers (2 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
40
40
protected website for classroom use.
Analyzing Graphics File Headers (3 of 3)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
41
41
protected website for classroom use.
 Tools for Viewing Images

• After recovering a graphics file

• Use an image viewer to open and view it
• No one viewer program can read every file format
• Having many different viewer programs is best
• Most GUI forensics tools include image viewers that display common image
formats
• Be sure to analyze, identify, and inspect every unknown file on a drive

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
42
42
protected website for classroom use.
 Understanding Steganography in Graphics
Files (1 of 7)
• Steganography hides information inside image files
• An ancient technique
• Two major forms: insertion and substitution
• Insertion
• Hidden data is not displayed when viewing host file in its associated program
- You need to analyze the data structure carefully
• Example: Web page

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
43
43
protected website for classroom use.
Understanding Steganography in Graphics
Files (2 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
44
44
protected website for classroom use.
Understanding Steganography in Graphics
Files (3 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
45
45
protected website for classroom use.
 Understanding Steganography in Graphics
Files (4 of 7)
• Substitution
• Replaces bits of the host file with other bits of data
• Usually change the last two LSBs (least significant bit)
• Detected with steganalysis tools (a.k.a - steg tools)
• You should inspect all files for evidence of steganography
• Clues to look for:
• Duplicate files with different hash values
• Steganography programs installed on suspect’s drive

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
46
46
protected website for classroom use.
Understanding Steganography in Graphics
Files (5 of 7)

Table 8-1 Bit breakdown of a secret message

Original Pixel Altered Pixel

1010 1010 1010 1001
1001 1101 1001 1110
1111 0000 1111 0011
0011 1111 0011 1100

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password- 47
protected website for classroom use.
Understanding Steganography in Graphics
Files (6 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
48
48
protected website for classroom use.
Understanding Steganography in Graphics
Files (7 of 7)

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
49
49
protected website for classroom use.
 Using Steganalysis Tools

• Use steg tools to detect, decode, and record hidden data

• Detect variations of the graphic image
• When done correctly you cannot detect hidden data in most cases
• Check to see whether the file size, image quality, or file extensions have
changed

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
50
50
protected website for classroom use.
 Understanding Copyright Issues with
Graphics
• Steganography has been used to protect copyrighted material
• By inserting digital watermarks into a file
• Digital investigators need to aware of copyright laws
• Copyright laws for Internet are not clear
• There is no international copyright law
• Check the U.S. Copyright Office
• U.S. Copyright Office identifies what can and can’t be covered under copyright law in
U.S.
• Fair use
• Another guideline to consider

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
51
51
protected website for classroom use.
 Summary (1 of 3)

• Three types of graphics files

• Bitmap
• Vector
• Metafile
• Image quality depends on various factors
• Standard file formats: .gif, .jpeg, .bmp, and .tif
• Nonstandard file formats: .tga, .rtl, .psd, and .svg
• Some image formats compress their data
• Lossless compression
• Lossy compression

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
52
52
protected website for classroom use.
 Summary (2 of 3)

• Digital camera photos are typically in raw and EXIF JPEG formats
• Recovering image files
• Carving file fragments
• Rebuilding image headers
• The Internet is best for learning more about file formats and their extensions
• Software
• Image editors
• Image viewers

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
53
53
protected website for classroom use.
 Summary (3 of 3)

• Steganography
• Hides information inside image files
• Forms
- Insertion
- Substitution

• Steganalysis
• Finds whether image files hide information
• Fair use allows using copyrighted material for noncommercial or educational
purposes without having to compensate the material’s originator or owner

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
54
54
protected website for classroom use.