Professional Documents
Culture Documents
COMPUTER FORENSICS
Chapter 7 Image Files
Forensics Mohd Taufik Abdullah
Department of Computer Science
Faculty of Computer Science and Information Technology
University Putra of Malaysia
A grayscale Image
A color image
Bitmap images:
collection of dots
type format
Vector graphics: based on mathematical
instructions/equations
Metafile graphics: combination of bitmap and
vector images
7 Chapter 7 Image Files Forensics SAK4801 Introduction to Computer
7.2 Recognize Image Files
(Cont.)
The circled area
in this screen
shot shows the
resolution of the
screen by pixels
applications:
Photoshop
MS Paint
Image Ready
Paintshop Pro
Raster images
Pixels are stored in rows
shapes
Smaller size
Autocad (.dxf)
Freehand (.fh9)
Paintbrush (.pcx)
cameras
Sensors in the digital camera simply record pixels
formats
The process of converting raw picture data to
file
With tools such as ProDiscover and Exif Reader
case
.mp3/.ra/.wav/.wma
Video file format
.avi/.mov/.movie/.mpg/.mpeg/.qt/.ram
Document file format .doc/.pdf/.ps
Data compression
Coding of data from a larger to a smaller form
Types
lossy compression
Lossy compression
vectors
24 Chapter 7 Image in the graphics fileSAK4801 Introduction to Computer
Files Forensics
7.4 Locate and Recover
Images Files
7.4 Locate and Recover Image
Files
Operating
system tools
Time consuming
analysis
Reconstruct fragmented image files
together
do not recognize
Use hex editor such as Hex Workshop
Record hexadecimal values on header
file
Determine the starting and ending cluster
editor
www.wotsit.org
http://whatis.techtarget.com
QuickView
IrfanView
EnCase
FTK
X-Ways Forensics
iLook
files
Ancient technique
Insertion
Hidden data is not displayed when viewing
carefully
Example: Web page
Hard to detect
versions
Mathematical calculations verify size and palette
color
Compare hash values
law
Check www.copyright.gov
Vector
Metafile
Nonstandard
kompresi lossy
Software
Editor gambar
Penampil gambar
Bentuk
Insersi
Substitusi
Steganalysis
Menemukan apakah file gambar
menyembunyikan informasi