Title: 2. Identifying Unknown File Formats
Course: IN 2005 Digital Forensics > Section: Module 10: Chapter 10 - Recovering Graphics Files

Identifying Unknown File Formats

1. Use the Internet as your main source for finding explanations and viewers for uncommon or unknown image formats. Some of the most useful Web sites include:
  - Google.com
  - File Formats
  - Whatis.com website

Analyzing Graphics File Headers

1. You should analyze graphics file headers when you find files that your tools do not recognize.
2. Use a hexadecimal editor, such as Hex Workshop, to analyze an unknown graphics file header. See Figures 10-25 and 10-26.

Tools for Viewing Images

1. Some of the image viewers that can be used with graphics files, including:
  - ThumbsPlus
  - ACDSee
  - QuickView
  - IrfanView
2. Most GUI computer forensics tools include image viewers that display only common image formats, especially GIF and JPEG.  Tools include:
  - ProDiscover
  - EnCase
  - FTK
  - X-Ways Forensics
  - iLook

Understanding Stenography on Image Files

1. Steganography is the art of hiding information inside image files.
2. Two major steganography forms:
  - Insertion
  - Substitution
3. With insertion steganography, the hidden data is not displayed when viewing the host file in its associated program. For that, you need to analyze the data structure carefully.  See Figures 10-27 and 10-28.
4. Substitution steganography replaces bits of the host file with bits of data.  It usually changes the last two LSBs and is detected with steganalysis tools. See Figures 10-29 and 10-30.

Using Steganalysis Tools

1. Steganalysis tools, also called steg tools, are used to find information hidden in graphics images. This can be a very time-consuming task.  Furthermore, when steganography has been applied correctly, in most cases you cannot find the hidden data.
2. Some of the methods steg tools employ when analyzing image files, including:
  - Compare suspect file to good or bad image versions
  - Mathematical calculations verify size and palette color
  - Compare hash values