Title: 1. Recognizing a Graphics File
Course: IN 2005 Digital Forensics > Section: Module 10: Chapter 10 - Recovering Graphics Files

Recognizing a Graphics File

1. A graphics file is a file that contains digital photographs, line art, three-dimensional images and scanned replicas of printed pictures.
2. Three kinds of graphics files:
  - Bitmap
  - Vector
  - Metafile
3. Both types of programs to work with graphics files:
  - Graphics editors
  - Image viewers

Understanding Bitmap and Raster Images

1. The differences between bitmap images and raster images.  Bitmap images store images as grids of individual pixels while raster images store pixels in rows.  Raster images are better for printing purposes.
2. The different factors that can alter the quality of an image, including:
  - Screen resolution
  - Software
  - Number of color bits used per pixel

Understanding Vector Images

1. The main characteristics of vector images:
  - Use lines
  - Store only the mathematics for drawing lines and shapes
  - Smaller size
  - Preserve quality when image is enlarged
2. Some of the software you can use with vector images.
  - CorelDraw
  - Adobe Illustrator

Understanding Metafile Graphics

1. Metafile graphics combine both raster and vector images.  Metafile graphics inherit advantages and disadvantages from both types.

Understanding Graphics File Formats

1. Some of the standard bitmap image file formats, including:
  - Graphic Interchange Format (.gif)
  - Joint Photographic Experts Group (.jpeg, .jpg)
  - Tagged Image File Format (.tiff, .tif)
  - Window Bitmap (.bmp)
2. Some of the standard vector image file formats, including:
  - Hewlett Packard Graphics Language (.hpgl)
  - Autocad (.dxf)
3. A list of nonstandard image file formats like:
  - Targa (.tga)
  - Raster Transfer Language (.rtl)
  - Adobe Photoshop (.psd) and Illustrator (.ai)
  - Freehand (.fh9)
  - Scalable Vector Graphics (.svg)
  - Paintbrush (.pcx)
4. Tearch the Web for software to manipulate unknown image formats.

Understanding Digital Camera File Formats

1. Witnesses or suspects can create their own digital photos.
2. Raw file format, referred to as a digital negative, is typically found on many higher-end digital cameras.  Sensors in the digital camera simply record pixels on the camera’s memory card.
3. The advantage of the raw format is that it maintains the best picture quality.  The biggest disadvantage is that it’s proprietary and not all image viewers can display these formats.
4. Demosaicing is the process of converting raw picture data to another format.
5. Exchangeable Image File (EXIF) format is a standard developed by JEIDA for storing metadata in JPEG and TIFF files.  EXIF is commonly used to store digital pictures.
6. Since the EXIF format collects metadata, investigators can learn more about the type of digital camera and the environment in which pictures were taken.  EXIF files store metadata at the beginning of the file. See Figures 10-1 through 10-3.
7. With tools such as ProDiscover and Exif Reader, you can extract metadata as evidence for your case.  See Figure 10-4.

Repairing Damaged Headers

1. You can identify image file headers from fragments found on slack or free disk space.

Searching for and Carving Data from Unallocated Space.

1. See Figures 10-7 through 10-12 to show you how to use ProDiscover to search and carve data.

Rebuilding File Headers

1. See Figures 10-13 through 10-17 to explain the main steps for rebuilding a damaged image file header, including:
  - Recover more pieces of file if needed
  - Examine file header
  - Compare with a good header sample
  - Manually insert correct hexadecimal values
  - Test corrected file

Reconstructing File Fragments

1. See  Figures 10-18 through 10-23 for the major steps for reconstructing file fragments, including:
  - Locate and export all clusters of the fragmented file
  - Determine the starting and ending cluster numbers for each fragmented group of clusters
  - Copy each fragmented group of clusters in their proper sequence to a recovery file
2. Rebuild the corrupted file’s header to make it readable in a graphics viewer
3. Sometimes suspects intentionally corrupt cluster links in a disk’s FAT.  Bad clusters appear with a zero value on a disk editor.  See Figure 10-24.