Title: Module Two Quiz
Course: CAP 2141 Digital Forensics II > Section: Module 2 Recovering Graphic Files

Q: ____ steganography places data from the secret file into the host file without displaying the secret data when you view the host file in its associated program.
- Replacement
- Append
- Substitution
- Insertion
A: Insertion

Q: ____ steganography replaces bits of the host file with other bits of data.
- Insertion
- Replacement
- Substitution
- Append
A: Substitution

Q: The ____ header starts with hexadecimal 49 49 2A and has an offset of four bytes of 5C01 0000 2065 5874 656E 6465 6420 03.
- TIFF
- XIF
- JPEG
- GIF
A: XIF

Q: ____ is the art of hiding information inside image files.
- Steganography
- Steganalysis
- Graphie
- Steganos
A: Steganography

Q: When working with image files, computer investigators also need to be aware of ____ laws to guard against copyright violations.
- international
- forensics
- copyright
- civil
A: copyright

Q: Under copyright laws, computer programs may be registered as ____.
- literary works
- motion pictures
- architectural works
- audiovisual works
A: literary works

Q: In the following list, ____ is the only steg tool.
- EnCase
- iLook
- DriveSpy
- Outguess
A: Outguess

Q: ____ has also been used to protect copyrighted material by inserting digital watermarks into a file.
- Encryption
- Steganography
- Compression
- Archiving
A: Steganography

Q: Recovering pieces of a file is called ____.
- carving
- slacking
- saving
- rebuilding
A: carving

Q: A(n) ____ file has a hexadecimal header value of FF D8 FF E0 00 10.
- EPS
- BMP
- GIF
- JPEG
A: JPEG

Q: The majority of digital cameras use the ____ format to store digital pictures.
- EXIF
- TIFF
- PNG
- GIF
A: EXIF

Q: ____ compression compresses data by permanently discarding bits of information in the file.
- Redundant
- Lossy
- Huffman
- Lossless
A: Lossy

Q: The image format XIF is derived from the more common ____ file format.
- GIF
- JPEG
- BMP
- TIFF
A: TIFF

Q: The simplest way to access a file header is to use a(n) ____ editor
- hexadecimal
- image
- disk
- text
A: hexadecimal

Q: If a graphics file is fragmented across areas on a disk, first you must recover all the fragments to re-create the file.
- true
- false
A: true

Q: Operating systems do not have tools for recovering image files.
- true
- false
A: false

Q: Steganography cannot be used with file formats other than image files.
- true
- false
A: false

Q: With many computer forensics tools, you can open files with external viewers.
- true
- false
A: true

Q: Identify and describe some image viewers.

Q: Explain how someone can use a disk editor tool to mark clusters as “bad” clusters.