Question

Use Linux forensic tools

Describe types of graphic file formats. Describe how to locate and recover graphic files

Explain types of data compression

Describe how to identify unknown file formats

Explain copyright issues with graphics

Answer 1

--->>TYPES OF GRAPHIC FORMATS

There are a number of different types of graphics file formats. Each type stores graphics data in a different way. Bitmap, vector, and metafile formats are by far the most commonly used formats, and we focus on these. However, there are other types of formats as well--scene, animation, multimedia, hybrid, hypertext, hypermedia, 3D, virtual modeling reality language (VRML), audio, font, and page description language (PDL). The increasing popularity of the World Wide Web has made some of these formats more popular, and we anticipate increased interest in them in the future. Although most of these file types are outside the scope of this book, we do introduce them in this section.

• Bitmap Formats

Bitmap formats are used to store bitmap data. Files of this type are particularly well-suited for the storage of real-world images such as photographs and video images. Bitmap files, sometimes called raster files, essentially contain an exact pixel-by-pixel map of an image. A rendering application can subsequently reconstruct this image on the display surface of an output device.

Microsoft BMP, PCX, TIFF, and TGA are examples of commonly used bitmap formats. Chapter 3 describes the construction of bitmap files in some detail.

• Vector Formats

Vector format files are particularly useful for storing line-based elements, such as lines and polygons, or those that can be decomposed into simple geometric objects, such as text. Vector files contain mathematical descriptions of image elements, rather than pixel values. A rendering application uses these mathematical descriptions of graphical shapes (e.g., lines, curves, and splines) to construct a final image.

In general, vector files are structurally simpler than most bitmap files and are typically organized as data streams.

AutoCAD DXF and Microsoft SYLK are examples of commonly used vector formats. Chapter 4, Vector Files, describes the construction of vector files in some detail.

• Metafile Formats

Metafiles can contain both bitmap and vector data in a single file. The simplest metafiles resemble vector format files; they provide a language or grammar that may be used to define vector data elements, but they may also store a bitmap representation of an image. Metafiles are frequently used to transport bitmap or vector data between hardware platforms, or to move image data between software platforms.

WPG, Macintosh PICT, and CGM are examples of commonly used metafile formats. Chapter 5, Metafiles, describes the construction of metafiles in some detail.

• Scene Formats

Scene format files (sometimes called scene description files) are designed to store a condensed representation of an image or scene, which is used by a program to reconstruct the actual image. What's the difference between a vector format file and a scene format file? Just that vector files contain descriptions of portions of the image, and scene files contain instructions that the rendering program uses to construct the image. In practice it's sometimes hard to decide whether a particular format is scene or vector; it's more a matter of degree than anything absolute.

• Animation Formats

Animation formats have been around for some time. The basic idea is that of the flip-books you played with as a kid; with those books, you rapidly displayed one image superimposed over another to make it appear as if the objects in the image are moving. Very primitive animation formats store entire images that are displayed in sequence, usually in a loop. Slightly more advanced formats store only a single image but multiple color maps for the image. By loading in a new color map, the colors in the image change, and the objects appear to move. Advanced animation formats store only the differences between two adjacent images (called frames) and update only the pixels that have actually changed as each frame is displayed. A display rate of 10-15 frames per second is typical for cartoon-like animations. Video animations usually require a display rate of 20 frames per second or better to produce a smoother motion.

TDDD and TTDDD are examples of animation formats.

• Multimedia Formats

Multimedia formats are relatively new but are becoming more and more important. They are designed to allow the storage of data of different types in the same file. Multimedia formats usually allow the inclusion of graphics, audio, and video information. Microsoft's RIFF, Apple's QuickTime, MPEG, and Autodesk's FLI are well-known examples, and others are likely to emerge in the near future. Chapter 10, Multimedia, describes various issues concerning multimedia formats.

• Hybrid Formats

Currently, there is a good deal of research being conducted on the integration of unstructured text and bitmap data ("hybrid text") and the integration of record-based information and bitmap data ("hybrid database"). As this work bears fruit, we expect that hybrid formats capable of efficiently storing graphics data will emerge and will steadily become more important.

• Hypertext and Hypermedia Formats

Hypertext is a strategy for allowing nonlinear access to information. In contrast, most books are linear, having a beginning, an end, and a definite pattern of progression through the text. Hypertext, however, enables documents to be constructed with one or more beginnings, with one, none, or multiple ends, and with many hypertext links that allow users to jump to any available place in the document they wish to go.

Hypertext languages are not graphics file formats, like the GIF or DXF formats. Instead, they are programming languages, like PostScript or C. As such, they are specifically designed for serial data stream transmission. That is, you can start decoding a stream of hypertext information as you receive the data. You need not wait for the entire hypertext document to be downloaded before viewing it.

The term hypermedia refers to the marriage of hypertext and multimedia. Modern hypertext languages and network protocols support a wide variety of media, including text and fonts, still and animated graphics, audio, video, and 3D data. Hypertext allows the creation of a structure that enables multimedia data to be organized, displayed, and interactively navigated through by a computer user.

Hypertext and hypermedia systems, such as the World Wide Web, contain millions of information resources stored in the form of GIF, JPEG, PostScript, MPEG, and AVI files. Many other formats are used as well.

• 3D Formats

Three-dimensional data files store descriptions of the shape and color of 3D models of imaginary and real-world objects. 3D models are typically constructed of polygons and smooth surfaces, combined with descriptions of related elements, such as color, texture, reflections, and so on, that a rendering application can use to reconstruct the object. Models are placed in scenes with lights and cameras, so objects in 3D files are often called scene elements.

Rendering applications that can use 3D data are generally modeling and animation programs, such as NewTek's Lightwave and Autodesk's 3D Studio. They provide the ability to adjust the appearance of the rendered image through changes and additions to the lighting, textures applied to scene elements, and the relative positions of scene elements. In addition, they allow the user to animate, or assign motions to, scene elements. The application then creates a series of bitmap files, or frames, that taken in sequence can be assembled into a movie.

It's important to understand that vector data historically has been 2D in nature. That is, the creator application with which the data originated made no attempt to simulate 3D display through the application of perspective. Examples of vector data include CAD drawings and most clip art designed to be used in desktop publishing applications. There is a certain amount of confusion in the market about what constitutes 3D rendering. This is complicated by the fact that 3D data is now supported by a number of formats that previously stored only 2D vector data. An example of this is Autodesk's DXF format. Formats like DXF are sometimes referred to as extended vector formats.

• Virtual Reality Modeling Language (VRML) Formats

VRML (pronounced "vermel") may be thought of as a hybrid of 3D graphics and HTML. VRML v1.0 is essentially a subset of the Silicon Graphics Inventor file format and adds to it support for linking to Uniform Resource Locators URLs in the World Wide Web.

VRML encodes 3D data in a format suitable for exchange across the Internet using the Hypertext Transfer Protocol (HTTP). VRML data received from a Web server is displayed on a Web browser that supports VRML language interpretation. We expect that VRML-based 3D graphics will soon be very common on the World Wide Web.

This book does not contain an in-depth discussion of VRML for some of the same reasons that we do not provide detailed descriptions of hypertext, hypermedia, and 3D formats.

• Audio Formats

Audio is typically stored on magnetic tape as analog data. For audio data to be stored on media such as a CD-ROM or hard disk, it must first be encoded using a digital sampling process similar to that used to store digital video data. Once encoded, the audio data can then be written to disk as a raw digital audio data stream, or, more commonly, stored using an audio file format.

Audio file formats are identical in concept to graphics file formats, except that the data they store is rendered for your ears and not for your eyes. Most formats contain a simple header that describes the audio data they contain. Information commonly stored in audio file format headers includes samples per second, number of channels, and number of bits per sample. This information roughly corresponds to the number of samples per pixel, number of color planes, and number of bits per sample information commonly found in graphics file headers.

Where audio file formats differ greatly is in the methods of data compression they use. Huffman encoding is commonly used for both 8-bit graphical and audio data. 16-bit audio data, however, requires algorithms specially adapted to the problems of compressing audio data. Such compression schemes include the CCITT (International Telegraph and Telephone Consultative Committee) recommendations G.711 (uLAW), G.721 (ADPCM 32) and G.723 (ADPCM 24), and the U.S. federal standards FIPS-1016 (CELP) and FIPS-1015 (LPC-10E).

• Font Formats

Another class of formats not covered in this book are font files. Font files contain the descriptions of sets of alphanumeric characters and symbols in a compact, easy-to-access format. They are generally designed to facilitate random access of the data associated with individual characters. In this sense, they are databases of character or symbol information, and for this reason font files are sometimes used to store graphics data that is not alphanumeric or symbolic in nature. Font files may or may not have a global header, and some files support sub-headers for each character. In any case, it is necessary to know the start of the actual character data, the size of each character's data, and the order in which the characters are stored in order to retrieve individual characters without having to read and analyze the entire file. Character data in the file may be indexed alphanumerically, by ASCII code, or by some other scheme. Some font files support arbitrary additions and editing, and thus have an index somewhere in the file to help you find the character data.

Some font files support compression, and many support encryption of the character data. The creation of character sets by hand has always been a difficult and time-consuming process, and typically a font designer spent a year or more on a single character set. Consequently, companies that market fonts (called foundries for reasons dating back to the origins of printing using mechanical type) often seek to protect their investments through legal means or through encryption. In the United States, for instance, the names of fonts are considered proprietary, but the outlines described by the character data are not. It is not uncommon to see pirated data embedded in font files under names different from the original.

Historically there have been three main types of font files: bitmap, stroke, and spline-based outlines, described in the following sections.

We choose not to cover font files in this book because font technology is a world to itself, with different terminology and concerns. Many of the font file formats are still proprietary and encrypted and, in fact, are not available to the general public. Although there are a few older spline-based font formats still in use, font data in the TrueType and Adobe Type 1 formats is readily available on all the major platforms and is well-documented elsewhere in publications readily available to developers.

• Bitmap fonts

Bitmap fonts consist of a series of character images rendered to small rectangular bitmaps and stored sequentially in a single file. The file may or may not have a header. Most bitmap font files are monochrome, and most store fonts in uniformly sized rectangles to facilitate speed of access. Characters stored in bitmap format may be quite elaborate, but the size of the file increases, and, consequently, speed and ease of use decline with increasingly complex images.

The advantages of bitmap files are speed of access and ease of use--reading and displaying a character from a bitmap file usually involve little more than reading the rectangle containing the data into memory and displaying it on the display surface of the output device. Sometimes, however, the data is analyzed and used as a template for display of the character by the rendering application. The chief disadvantages of bitmap fonts are that they are not easily scaled, and that rotated bitmap fonts look good only on screens with square pixels.

Most character-based systems, such as MS-DOS, character-mode UNIX, and character terminal-based systems use bitmap fonts stored in ROM or on disk. However, bitmap fonts are seldom used today when sufficient processing power is available to enable the use of other types of font data.

• Stroke fonts

Stroke fonts are databases of characters stored in vector form. Characters can consist of single strokes or may be hollow outlines. Stroke character data usually consists of a list of line endpoints meant to be drawn sequentially, reflecting the origin of many stroke fonts in applications supporting pen plotters. Some stroke fonts may be more elaborate, however, and may include instructions for arcs and other curves. Perhaps the best-known and most widely used stroke fonts were the Hershey character sets, which are still available online.

The advantages of stroke fonts are that they can be scaled and rotated easily, and that they are composed of primitives, such as lines and arcs, which are well-supported by most GUI operating environments and rendering applications. The main disadvantage of stroke fonts is that they generally have a mechanical look at variance with what we've come to expect from reading high-quality printed text all our lives.

Stroke fonts are seldom used today. Most pen plotters support them, however. You also may need to know more about them if you have a specialized industrial application using a vector display or something similar.

• Spline-based outline fonts

Character descriptions in spline-based fonts are composed of control points allowing the reconstruction of geometric primitives known as splines. There are a number of types of splines, but they all enable the drawing of the subtle, eye-pleasing curves we've come to associate with high-quality characters that make up printed text. The actual outline data is usually accompanied by information used in the reconstruction of the characters, which can include information about kerning, and information useful when scaling characters that are very large or very small ("hints").

The advantages of spline-based fonts are that they can be used to create high-quality character representations, in some cases indistinguishable from text made with metal type. Most traditional fonts, in fact, have been converted to spline-based outlines. In addition, characters can be scaled, rotated, and otherwise manipulated in ways only dreamed about even a generation ago.

Unfortunatly, the reconstruction of characters from spline outline data is no trivial task, and the higher quality afforded by spline outlines comes at a price in rendering time and program development costs.

• Page Description Language (PDL) Formats

Page description languages (PDLs) are actual computer languages used for describing the layout, font information, and graphics of printed and displayed pages. PDLs are used as the interpreted languages used to communicate information to printing devices, such as hardcopy printers, or to display devices, such as graphical user interface (GUI) displays. The greatest difference is that PDL code is very device-dependent. A typical PostScript file contains detailed information on the output device, font metrics, color palettes, and so on. A PostScript file containing code for a 4-color, A4-sized document can only be printed or displayed on a device that can handle these metrics.

Markup languages, on the other hand, contain no information specific to the output device. Instead, they rely on the fact that the device that is rendering the markup language code can adapt to the formatting instructions that are sent to it. The rendering program chooses the fonts, colors, and method of displaying the graphical data. The markup language provides only the information and how it is structured.

Although PDL files can contain graphical information, we do not consider PDLs to be graphics file formats any more than we would consider a module of C code that contains an array of graphical information to be a graphics file format. PDLs are complete programming languages, requiring the use of sophisticated interpreters to read their data; they are quite different from the much simpler parsers used to read graphics file formats.

---->>HOW TO LOCATE AND RECOVER GRAPHIC FILES

In a computer forensics investigation involving graphics files, you need to locate and recover all graphics files on the suspect drive and determine which ones are pertinent to your case. Because images aren’t always stored in standard graphics file formats, you should examine all files that your computer forensics tools find, even if they aren’t identified as graphics files. Some OSs have built-in tools for recovering graphics files, but they are time consuming, and the results are difficult to verify. Instead, you can use computer forensics tools dedicated to analyzing graphics files.Each graphics file contains a header with instructions for displaying the image; this header information helps you identify the file format. The header is complex and difficult to remember, however; instead of memorizing header information, you can compare a known good file header with that of a suspected file. For example, if you find an image that you suspect is a JPEG file but can’t display it with a bitmap graphics program, compare its file header with a known JPEG file header to determine whether the header has been altered. You could then use the information in the known JPEG file header to supply instructions for displaying the image. In other words, you use the known JPEG header information to create a baseline analysis. Before you can examine a graphics file header, often you need to reconstruct a fragmented graphics file. To do so, you need to identify the data patterns the graphics file uses. If part of the file header has been overwritten with other data, you might also need to repair the damaged header. By rebuilding the file header, you can then perform a forensics analysis on the graphics file. These techniques are described in the following sections.

Identifying Graphics File Fragments:

If a graphics file is fragmented across areas on a disk, first you must recover all the fragments to re-create the file. Recovering file fragments is called carving, also known as salvaging outside North America. To carve a graphics file’s data from file slack space and free space, you should be familiar with the data patterns of known graphics file types. Many computer forensics programs, such as ProDiscover or FTK, can recognize these data patterns and carve the graphics files from slack and free space automatically, however. After you recover fragments of a graphics file, you restore them to continue your examination. You use ProDiscover Basic and Hex Workshop later in this chapter to copy known data patterns from files you recover, and then restore this information to view the graphics file.

Repairing Damaged Headers:

When you’re examining recovered fragments from files in slack or free space, you might find data that appears to be a header for a common graphics file type. If you locate header data that’s partially overwritten, you must reconstruct the header to make it readable by comparing the hexadecimal values of known graphics file formats to the pattern of the file header you found. Each graphics file type has a unique header value. As you become familiar with these header values, you can spot data from partially overwritten headers in file slack or free space. For example, as mentioned earlier, a JPEG file has the hexadecimal header value FFD8, followed by the label JFIF for a standard JPEG or EXIF file at offset 6. Suppose you’re investigating a possible intellectual property theft by a contract employee of Exotic Mountain Tour Service (EMTS). EMTS has just finished an expensive marketing and customer service analysis with Superior Bicycles, LLC. Based on this analysis, EMTS plans to release advertising for its latest tour service with a joint product marketing campaign with Superior Bicycles. Unfortunately, EMTS suspects that a contract travel consultant, Bob Locating and Recovering Graphics Files 389 Aspen, might have given sensitive marketing data to another bicycle competitor. EMTS is under a nondisclosure agreement with Superior Bicycles and must protect this advertising campaign material. An EMTS manager found a USB drive on the desk Bob Aspen was assigned to. Your task is to determine whether the drive contains proprietary EMTS or Superior Bicycles data. The EMTS manager also gives you some interesting information he gathered from the Web server administrator. EMTS filters all Web-based e-mail traffic traveling through its network and detects suspicious attachments. When a Web-based e-mail with attachments is received, the Web filter is triggered.For this examination, you need to search for all possible places data might be hiding. To do this, in the next section you use ProDiscover’s cluster search function with hexadecimal search strings to look for known data.

Searching for and Carving Data from Unallocated Space:

At this time, you have little information on what to look for on the USB drive Bob Aspen used. You need to ask some basic questions and make some assumptions based on available information to proceed in your search for information. In the first message from terrysadler@goowy.com, you see that it’s addressed to baspen99@aol.com, which matches the contract employee’s name, Bob Aspen. Next, you look at the date and time stamps in this message. The first is 4 Feb 2007 9:21 PM, First intercepted capture of an e-mail from Terry Sadler 390 Chapter 10 10 second, farther down, is a header from Jim Shu with a date and time stamp of February 5, 2007, 5:17 AM -08:00. Therefore, it seems that Jim Shu originally sent the message, which was then forwarded to the terrysadler@goowy.com account. Because the time stamp for Jim Shu is later than the time stamp for terrysadler@goowy.com, Terry Sadler’s location might be in a different time zone, somewhere west of Jim Shu, or one of the two e-mail server’s time values is off because e-mail servers, not users, provide time stamps. In Chapter 12, you learn more about e-mail header information. Continuing with the first message, you note that Jim is telling Terry to have Bob alter the file extensions from .txt to .jpg, and the files are about new kayaks. The last line appears to be a previous response from terrysadler@goowy.com commenting that Bob (assuming it’s Bob Aspen) can’t receive this message. So far, you have the following facts: • Jim Shu’s e-mail refers to JPEG files. • Jim Shu’s attached JPEG files need to have the extension renamed from .txt to .jpg. • Jim Shu’s attachments might be photographs of new kayaks. • The e-mail account names in this message are terrysadler@goowy.com, baspen99@aol.com, and jim_shu1@yahoo.com. Now examine the second e-mail, which contains the following pieces of information: • Jim Shu had a tour of the new kayak factory. • Another party might be interested in competing in manufacturing kayaks. • Jim Shu smuggled out JPEG photos he modified with a hexadecimal editor so that they wouldn’t be detected by any Web or e-mail filters. Second intercepted capture of an e-mail from denisesuperbic@hotmail.com

Locating and Recovering Graphics Files:

391 • Jim Shu provides specific instructions on how to reedit the digital photos and add the .jpeg extension so that they can be viewed. • Jim Shu thinks Bob Aspen is working at EMTS. • Jim Shu sent a copy (CC) to nautjeriko@lycos.com. With these collected facts and your knowledge of JPEG file structures, you can use the steps in the following sections to determine whether these allegations are true. Planning Your Examination In the second e-mail from Jim Shu to Terry Sadler, Jim states, “So to view them you have to re-edit each file to the proper JPEG header of offset 0x FF D8 FF E0 and offset 6 of 4A.” From this statement, you can assume that any kayak photographs on the USB drive contain unknown characters in the first four bytes and the sixth byte. Because this is all Jim Shu said about the JPEG files, you need to assume that the seventh, eighth, and ninth bytes have the original correct information for the JPEG file. In “Examining the Exchangeable Image File Format,” you learned the difference between a standard JFIF JPEG and an EXIF JPEG file: The JFIF format has 0x FFD8 FFE0 in the first four bytes, and the EXIF format has 0x FFD8 FFE1. In the sixth byte, the JPEG label is listed as JFIF or EXIF. In the second e-mail, Jim Shu mentions 0x FF D8 FF E0, which is a JFIF JPEG format. He also says to change the sixth byte to 0x 4A, which is the uppercase letter “J” in ASCII. Because the files might have been downloaded to the USB drive, Bob Aspen could have altered or deleted them, so you should be thorough in your examination and analysis. You need to search all sectors of the drive for deleted files, both allocated space (in case Bob didn’t modify the files) and unallocated space. In the next section, you use ProDiscover to search for and recover these JPEG files.

Searching for and Recovering Digital Photograph:

Evidence In this section, you learn how to use ProDiscover to search for and extract (recover) possible evidence of JPEG files from the USB drive the EMTS manager gave you. The search string to use for this examination is “FIF.” Because it’s part of the label name of the JFIF JPEG format, you might have several false hits if the USB drive contains several other JPEG files. These false hits, referred to as false positives, require examining each search hit to verify whether it’s what you are looking for.Create this folder on your system first, if necessary. Remember that the work folder you create most likely has a different name from what’s shown in screenshots. To begin the examination, follow these steps to load the image file:

1. Start ProDiscover Basic (with the Run as administrator option if you’re using Windows Vista), and click the New Project toolbar button. In the New Project dialog box, type C10InChp for the project number and filename, and then click OK.

2. Click Action from the menu, point to Add, and click Image file.

3. In the Open dialog box, navigate to your work folder, click C and then click Open. If necessary, click Yes in the Auto Image Checksum message box.

4. To begin a search, click the Search toolbar button or click Action, Search from the menu to open the Search dialog box.

5. Click the Cluster Search tab, and then click the Case Sensitive check box. Under Search for the pattern(s), type FIF Under Select the Disk(s)/Image(s) you want to search in, click the C10InChp.eve file, and then click OK.

6. When the search is done, click the first search hit, 4CA(1226), to display the cluster’s content Searching clusters in ProDiscover Locating and Recovering Graphics Files 393

7. Double-click the highlighted row 4CA(1226) to display the cluster view Completed cluster search for FIF Viewing cluster use and location of search hit for 4CA(1226) , the header for this JPEG file has been overwritten with zzzz. This unique header information might give you additional search values that could minimize false-positive hits in subsequent searches.

8. Next, you need to locate the file. Right-click cluster block 4CA(1226) and click Find File, and then click Yes in the warning message.

9. In the List of Clusters dialog box, click Show File (see Figure 10-11), and then click Close. Viewing all clusters used by the gametour2.exe file Locating and Recovering Graphics Files 395

10. In the work area, right-click the gametour2.exe file and click Copy File. In the Save As dialog box, delete the original filename, type Recover1.jpg, and then click Save to save this file in your work folder.

11. Click File, Exit from the menu, and then click Yes to save this project in your work folder. The next section shows you how to rebuild header data from this recovered file by using Hex Workshop, although any hexadecimal editor has the capability to examine and repair damaged file headers.

From a computer forensics view, this procedure can be considered corrupting the evidence, but knowing how to reconstruct data, as in the preceding example, is part of an investigator’s job. When you change data as part of the recovery and analysis process, make sure you document your steps as part of your reporting procedures. Your documentation should be detailed enough that other investigators could repeat the steps, which increases the credibility of your findings. When you’re rebuilding a corrupted evidence image file, create a new file and leave the original file in its initial corrupt condition.

Rebuilding File Headers:

Before attempting to edit a graphics file you have recovered, try to open it with an image viewer, such as the default Microsoft tool. To test whether you can view the image, doubleclick the recovered file in its current location in Windows Explorer. If you can open and Mislabeled file that appears to be altered intentionally the image, you have recovered the graphics file successfully. If the image isn’t displayed, you have to inspect and correct the header values manually. If some of the data you recovered from the graphics file header is corrupt, you might need to recover more pieces of the file before you can view the image, as you’ll see in the next section. Because the deleted file you recovered in the previous activity, was altered intentionally, when you attempt to open it, you might see an error message similar to the one in . If you can’t open a graphics file in an image viewer, the next step is to examine the file’s header data to see whether it matches the header in a good JPEG file. If the header doesn’t match, you must insert the correct hexadecimal values manually with a hexadecimal editor. To inspect a file with Hex Workshop, follow these steps:

1. Start Hex Workshop. Click File, Open from the menu. Navigate to your work folder, and then double-click shows this file open in Hex Workshop.

2. At the top of the Hex Workshop window, note that the hexadecimal values starting at the first byte position (offset 0) are 7A 7A 7A 7A, and the sixth position (offset 6) is also 7A. Leave Hex Workshop open for the next set of steps.  Error message indicating a damaged or an altered graphics file

Locating and Recovering Graphics Files:

As mentioned, a standard JFIF JPEG file has a header value of FF D8 FF E0 from offset 0 and the label name JFIF starting at offset 6. Using Hex Workshop, you can correct this file header manually by following these steps:

1. In the center pane, click to the left of the first 7A hexadecimal value. Then type FF D8 FF E0, which are the correct hexadecimal values for the first 4 bytes of a JPEG file.

2. In the right pane, click to the left of FIF, backspace to delete the z, and type J, . Figure 10-14 Recover1.jpg open in Hex Workshop Inserting correct hexadecimal values for a JPEG file In Hex Workshop, when you type a keyboard character in the right pane, the corresponding hexadecimal value appears in the center pane. So, for example, when you type J in the right pane, the hexadecimal value 4A appears in the center pane.

3. Click File, Save As from the menu. In the Save As dialog box, navigate to your work folder, type Fixed1.jpg as the filename, and then click Save. Exit Hex Workshop. Every two hexadecimal values you entered in the previous steps are equivalent to one ASCII character.

For example, an uppercase “A” has the hexadecimal value 41, and a lowercase “a” has the hexadecimal value 61. Most disk editors have a reference chart for converting hexadecimal values to ASCII characters, such as Hex Workshop’s After you repair a graphics file header, you can test the updated file by opening it in an image viewer, such as Windows Photo Gallery, IrfanView, ThumbsPlus, Quick View, or ACDSee. To test the repaired JPEG file, follow these steps:

1. In Windows Explorer, navigate to your work folder and double-click Fixed1.jpg. The file opens in your default image viewer, such as Windows Photo Gallery .

2. Verify that you have recovered the file correctly, and then exit the image viewer. The process of repairing file headers isn’t limited to JPEG files. You can apply the same technique to any file for which you can determine the header value, including Microsoft Word, Excel, and PowerPoint documents and other image formats. You need to know only the correct header format for the type of file you’re attempting to repair. Reconstructing File Fragments You might occasionally encounter corrupt data that prevents you from recovering data fragments for files. Whether the data corruption is accidental or intentional, you need to know how to examine a suspect drive and extract possible data fragments to reconstruct files for evidentiary purposes. In this section, you learn how to locate noncontiguous clusters from a deleted file. Modern computer forensics tools can typically follow the links between clusters for FAT and NTFS file systems. However, sometimes the pointer information in a FAT or an NTFS MFT file doesn’t list this information. ASCII equivalents of hexadecimal values Locating and Recovering Graphics Files 399 This following activity shows you how to recover a graphics file with a corrupt header that’s fragmented on the suspect drive. To perform this data-carving task, you need to locate the starting and ending clusters for each fragmented group of clusters in the corrupted file. Here’s an overview of the procedure:

1. Locate and export all clusters of the fragmented file.

2. Determine the starting and ending cluster numbers for each fragmented group of clusters.

3. Copy each fragmented group of clusters in their correct sequence to a recovery file.

4. Rebuild the corrupted file’s header to make it readable in a graphics viewer. Use the project you created previously, C10InChp, to analyze the fragmentation:

1. Start ProDiscover Basic (with the Run as administrator option in Windows Vista). Click File, Open Project from the menu, navigate to your work folder, click the C10InChp.dft file, and then click Open.

2. In the tree view, click Cluster Search Results, and then in the work area, click AE3 (2787),. Fixed1.jpg open in Windows Photo Gallery

3. Right-click the cluster row AE3(2787) and click Find File.

4. In the List of Clusters dialog box, click Copy to Clipboard. Start Notepad, paste the cluster into a new document, and save the file as AE3-carve.txt in your work folder. Leave Notepad open for the following steps.

5. In ProDiscover’s List of Clusters dialog box, click Close.

6. In the tree view, click to expand Cluster View, if necessary, click to expand Images, and then click the C10InChp.eve image file.

7. Examine the AE3-carve.txt file in Notepad to determine the clusters that are grouped together—the range for each cluster group. For example, locate the first cluster number, AE3, and count downward until you locate a cluster number that’s not sequential. Make note of the last contiguous cluster number before the change to determine the first cluster group for this fragmented file. Continue through the list of cluster numbers to determine all fragments. The following list shows the cluster groups you should find: • Fragment range 1—AE3 to B3F • Fragment range 2—1F5 to 248 • Fragment range 3—3EB to 425 • Fragment range 4—16A to 1A1 • Fragment range 5—957 to 98C • Fragment range 6—25 to 2C Figure 10-18 Cluster search results for the AE3(2787) cluster Locating and Recovering Graphics Files 401 The first fragment starts at hexadecimal AE3 (decimal 2787) and continues to hexadecimal B3F. The next fragment starts at 1F5 and continues to 248, and so on until the last segment of fragmented clusters. This file is very fragmented.

8. In ProDiscover’s tree view, click Cluster View, Images, and the C10InChp.eve file, if necessary. In the work area’s Sector text box, type AE3 and click Go. To view all cluster columns in the work area, , you need to maximize ProDiscover Basic’s view and increase the work area’s size. Drag its left border to the left, into the tree view, until you can see all 30 hexadecimal columns, and then release the mouse button.

9. In the work area, click to select all blocks from AE3 to B3F.

10. Right-click the highlighted blocks (sectors) in the work area and click Select. In the Add Comment dialog box, click the Apply to all items check box. In the Investigator comments text box, type Fragment 1 to recover, and then click OK.

11. Repeat Steps 8 through 10 to select the remaining fragmented blocks for these sectors: 1F5 to 248, 3EB to 425, 16A to 1A1, 957 to 98C, and 25 to 2C. In the Add Comment dialog box, increase the comment’s fragment number by 1 for each block: Fragment 2 to recover, Fragment 3 to recover, and so on.

12. After all sectors have been selected, click Tools, Copy Selected Clusters from the menu. Cluster view of C10InChp.eve

13. In the Recover Clusters dialog box, click the Recover all clusters to a single file option button and the Recover Binary check box . Click Browse, navigate to and click your work folder, and then click OK.

14. Exit ProDiscover Basic, saving this project in your work folder if prompted. Exit Notepad, saving the file if prompted. The next step would be rebuilding the header of this recovered file, as you did in a previous activity. When you copy the selected data with ProDiscover’s Recover Clusters function, a file named C10InChp-0000-0353.txt is created. ProDiscover adds a .txt extension automatically on all copied sectors or clusters the Recover Clusters function exports. Cluster view of sector AE3 Selected blocks from sector AE3 to B3F Locating and Recovering Graphics Files 403 In this recovered file, sector AE3 contains “FIF” preceded by the altered header you found at sector 4CA. To view and rebuild C10InChp-0000-0353.txt, you would use the techniques described previously in “Rebuilding File Headers.” Remember to save the updated recovered data with a .jpg extension. Figure 10-23 shows the results. Figure 10-22 Copying all selected clusters or sectors to a file Figure 10-23 Recovered data from starting sector AE3 after Hex Workshop corrects the header 404 Chapter 10 10 In addition to the natural occurrence of file fragmentation, sometimes suspects intentionally corrupt cluster links in a disk’s FAT. Anyone can use a disk-editing tool, such as Norton DiskEdit, to access the FAT and mark specific clusters as bad by typing the letter “B” at the cluster. After you mark a cluster as bad, it’s displayed with a 0 value in a disk editor. cluster position 156 has a 0 value, indicating that this cluster doesn’t link to any other clusters on the disk. The OS ignores clusters marked in this manner and doesn’t use them, which makes it possible to hide data in these clusters.

---->>TYPES OF DATA COMPRESSION

Most graphics file formats, including GIF and JPEG, compress data to save disk space and reduce the file’s transmission time. Other formats, such as BMP, rarely compress data or do so inefficiently. In this case, you can use compression tools to compact data and reduce file size. Data compression is the process of coding data from a larger form to a smaller form. Graphics files and most compression tools use one of two data compression schemes: lossless Exif Reader displaying metadata from an EXIF JPEG file Understanding Data Compression 387 or lossy. You need to understand how compression schemes work to know what happens when an image is altered. Lossless and Lossy Compression This section describes how lossless and lossy compression work, explains their advantages and disadvantages, and discusses what they mean in terms of computer forensics. Lossless compression techniques reduce file size without removing data. When you uncompress a file that uses lossless compression, you restore all its information. GIF and Portable Network Graphics (PNG) file formats reduce file size with lossless compression, which saves file space by using mathematical formulas to represent data in a file. These formulas generally use one of two algorithms: Huffman or Lempel-Ziv-Welch (LZW) coding. Each algorithm uses a code to represent redundant bits of data. For example, if a graphics file contains a large red area, instead of having to store 200 red bytes, the algorithm can set one byte to red and set another byte to specify 200 red bytes. Therefore, only 2 bytes are used. Lossy compression is much different because it compresses data by permanently discarding bits of information in the file. Some discarded bits are redundant, but others are not. When you uncompress a graphics file that uses lossy compression, you lose information, although most people don’t notice the difference unless they print the image on a high-resolution printer or increase the image size. In either case, the removed bits of information reduce image quality. The JPEG format is one that uses lossy compression. If you open a JPEG file in a graphics program, for example, and save it as a JPEG file with a different name, lossy compression is reapplied automatically, which removes more bits of data and, therefore, reduces image quality. If you simply rename a file by using Windows Explorer or the command line, however, the file doesn’t lose any more data. Another form of lossy compression, vector quantization (VQ), uses complex algorithms to determine what data to discard based on vectors in the graphics file. In simple terms, VQ discards bits in much the same way rounding off decimal values discards numbers. Some popular lossless compression utilities include WinZip, PKZip, StuffIt, and FreeZip. Lzip is a lossy compression utility. You use compression tools to compact folders and files for data storage and transmission. Remember that the difference between lossless and lossy compression is the way data is represented after it has been uncompressed. Lossless compression produces an exact replica of the original data after it has been uncompressed, whereas lossy compression typically produces an altered replica of the data.

---->>HOW TO IDENTIFY UNKNOWN FILE FORMATS

With the continuing changes in technology and computer graphics, eventually you’ll encounter graphics file formats you’re not familiar with. In addition, suspects might use older computer systems with programs that create files in uncommon or obsolete file formats. Therefore, you must research both old and new file types. Knowing the purpose of each format and how it stores data is part of the investigation process. The Internet is the best source for learning more about file formats and their extensions. You have already used the Webopedia site to research the TGA file format. You can also use a search engine to search for “file type” or “file format” and find the latest list of Web sites with information on file extensions. If you still can’t find a specific file extension, try refining your search by entering the file extension along with the words “file format” in a search engine. One nonstandard graphics file format is XIF. To search for information on this file format, follow these steps:

1. Start your Web browser, and go to www.google.com.

2. Type XIF file format in the text box and press Enter.

3. Click a few links in the search results to learn more about this file format. When you’re finished, exit your Web browser. Bad cluster appearing as 0 in Norton DiskEdit Identifying Unknown File Formats 405 Nuance PaperPort is a scanning program that produces images in the XIF format, which is derived from the TIF file format. Older versions of PaperPort have a free viewer utility for XIF files; you can also use Windows 2000 Kodak Imaging for Windows. For more information about XIF files, go to www.scantips.com/pagis1.html. The following sites provide information to help you analyze file formats. Keep in mind that information on the Web changes frequently; use a search engine to find graphics file information if you can’t access these Web sites: • www.digitek-asi.com/file_formats.html • www.wotsit.org • www.martinreddy.net/gfx/ Analyzing Graphics File Headers You should analyze graphics file headers when you find new or unique file types that computer forensics tools don’t recognize. The simplest way to access a file header is to use a hexadecimal editor, such as Hex Workshop. You can then record the hexadecimal values in the header and use them to define a file type. For example, suppose you encounter an XIF file, which you learned about in the previous section. Because this format is so old, not much information on it is available. If you need to look for hidden or deleted XIF files, you must build your own header search string. To do this, you need a hexadecimal editor, such as Hex Workshop. To see the differences between XIF and TIF, viewing and comparing header values for these file formats is good practice. TIF is a well-established file format for transmitting faxes and for use in printed publications. All TIF files start at offset 0 with hexadecimal 49 49 2A. These hexadecimal values translate to the letters “II” in ASCII. Figure 10-25 shows the Sawtooth_050.tif file open in Hex Workshop. A TIF file open in Hex Workshop 406 Chapter 10 10 The first 3 bytes of an XIF file are the same as a TIF file, followed by other hexadecimal values that distinguish it from a TIF file . As you can see, the XIF header starts with hexadecimal 49 49 2A and has an offset of 4 bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 64 20 03. (Some values have been cut off in Figure 10-26 to conserve space.) With this information, you can configure your computer forensics tool to detect an XIF file header. Tools for Viewing Images Throughout this chapter, you have been learning about recognizing file formats, using compression techniques, salvaging header information, recovering graphics files, and saving your modifications. After you recover a graphics file, you can use an image viewer to open and view it. Several hundred image viewers are available that can read many graphics file formats, although no one viewer program can read every file format. Therefore, having many different viewer programs for investigations is best. Many popular viewer utilities are freeware or shareware programs, such as ThumbsPlus, ACDSee, Quick View, and IrfanView, that can be used to view a wide range of graphics file formats. Most GUI computer forensics tools, such as ProDiscover, EnCase, FTK, X-Ways Forensics, and ILook, include image viewers that display only common image formats, especially GIF and JPEG, which are often found in Internet-related investigations. However, for less common file formats, such as PCX, integrated viewers often simply identify the data as a graphics file or might not recognize the data at all. Being unable to view all formats can prevent you from finding critical evidence for a case. Be sure that you analyze, identify, and inspect every unknown file on a drive. With many computer forensics tools, you can open files with external viewers. An XIF file open in Hex Workshop Identifying Unknown File Formats Understanding Steganography in Graphics Files When you open some graphics files in an image viewer, they might not seem to contain information related to your investigation. However, someone might have hidden information inside the image by using a data-hiding technique called steganography , which uses a host file to cover the contents of a secret message. Steganography has been used since ancient times. Greek rulers used this technique to send covert messages to diplomats and troops via messengers. To protect the message’s privacy, rulers shaved their messengers’ heads and tattooed messages on their scalps. After their hair grew enough to cover the message, the messengers left for their destinations, where they shaved their heads so that recipients could read the message. This method was a clever way to send and retrieve encrypted information, but it was inefficient because the messengers’ hair took a long time to grow back, and only a limited amount of space was available to write messages. However, it enabled the Greeks to send secret messages until their enemies discovered this early form of steganography and began intercepting messengers. Contemporary steganography is also inefficient because a graphics file can hide only a certain amount of information before its size and structure change. However, it does allow someone to send covert information to a recipient, unless someone else detects the hidden data. The two major forms of steganography are insertion and substitution. Insertion places data from the secret file into the host file. When you view the host file in its associated program, the inserted data is hidden unless you analyze the data structure carefully. For example, if you create a Web page with HTML, you can display images and text in a Web browser without revealing the HTML code. a typical Web page as it was A simple Web page displayed in a Web browser  intended to be viewed in a Web browser. This Web page contains hidden text, which along with the source HTML code. To detect hidden inserted text, you need to compare what the file displays and what the file contains. Depending on your skill level, this process can be difficult and time consuming. The second type of steganography, substitution, replaces bits of the host file with other bits of data. With a bitmap file, for example, you could replace bits used for pixels and colors with hidden data. To avoid detection, you substitute only those bits that result in the least amount of change. For example, if you use an 8-bit graphics file, each pixel is represented by 8 bits of data containing information about the color each pixel displays onscreen. The bits are prioritized from left to right, such as 11101100. The first bit on the left is the most significant bit (MSB), and the last bit on the right is the least significant bit (LSB). As the names suggest, changing the MSB affects the pixel display more than changing the LSB does. Furthermore, you can usually change only the last two LSBs in an image without producing a noticeable change in the shade of color the pixel displays. To detect a change to the last two LSBs in a graphics file, you need to use a steganalysis tool, which is software designed to identify steganography techniques. For example, if your secret message is converted to binary form to equal 01101100 and you want to embed this secret message into a picture, you alter the last 2 bits of four pixels. You break the binary form into sections of two, as in 01 10 11 00, and insert the bits into the last 2 bits of each pixel, as The HTML code reveals hidden text Table 10-1 Bit breakdown of a secret message Original pixel Altered pixel 1010 1010 1010 1001 1001 1101 1001 1110 1111 0000 1111 0011 0011 1111 0011 1100 Identifying Unknown File Formats The sequence of 2 bits is substituted for the last 2 bits of the pixel. This bit substitution can’t be detected by the human eye, which can see only about 6 bits of color. shows the original picture, a simple line drawing, on the left and the altered image on the right. The altered image contains the hidden picture . Whether insertion or substitution is used, graphics files are usually chosen for steganography because they contain enough bits to manipulate for hiding data. Therefore, you should always inspect graphics files for steganography evidence, especially if your suspect is technically savvy. Steganography can be used with file formats other than graphics files, such as MPEG and AVI files. Original and altered images Hidden picture in the altered image Using Steganalysis Tools You can use several different steganalysis tools (also called “steg tools”) to detect, decode, and record hidden data, even in files that have been renamed to protect their contents. If you suspect steganography has been used, search the suspect device for evidence of installed steganalysis tools. A steganalysis tool can also detect variations of an image. If a graphics file has been renamed, a steganalysis tool can identify the file format from the file header and indicate whether the file contains an image. Although steganalysis tools can help identify hidden data, steganography is generally difficult to detect. In fact, if steganography is done correctly, in most cases you can’t detect the hidden data unless you can compare the altered file with the original file. Check to see whether the file size, image quality, or file extensions have changed. If so, you might be dealing with a steganography image. As an example of the complexity of detecting steganography, Niels Provos and Peter Honeyman at the University of Michigan conducted a study of more than two million images used in eBay auctions to see whether hidden data might have been placed in photos (see www.citi.umich.edu/techreports/reports/ citi-tr-01-11.pdf). They were unable to determine whether any graphics files contained hidden messages. Steganography and steganalysis tools change as rapidly as some OSs. Current steg tools include Stegowatch, Outguess, StegDetect, and S-Tools. For a list of other steg tools, you can do an Internet search on “steganography” or “steganalysis.” Steganalysis tools usually compare a suspect file to a known good version or a known bad version of the graphics file. Some recent tools can detect steganography without a known good or bad file, however. Because graphics files are binary, these tools perform complex mathematical calculations to verify a file’s authenticity by checking file size and palette color. Other tools compare the hash value of a known good or bad file to the suspect file to determine whether steganography was used. You can also use steganalysis tools to determine which sectors of a graphics file hide data. Keep in mind that this investigation task can be time consuming. Your first obstacle is obtaining the original graphics file to compare to the suspected steganography file. In some cases, you can find the original file on the suspect’s computer or recover it, if it was deleted. If the filename has been changed, you might need to view each graphics file you recover to try to find a match. If you can’t find the original file, you can still analyze the suspect file by using a steganalysis tool to detect hidden data. In the Hands-On Projects at the end of this chapter, you analyze a steganography file.

---->>COPYRIGHT ISSUES WITH GRAPHICS

Steganography has also been used to protect copyrighted material by inserting digital watermarks into a file. When working with graphics files, computer investigators need to be aware of copyright laws, especially in the corporate environment, where they often work closely with the legal department to guard against copyright violations. Investigators might also need to Understanding Copyright Issues with Graphics determine whether a photo is from a known copyrighted source, such as a news photo being posted on a Web page without permission. The U.S. Copyright Office Web site defines precisely how copyright laws pertain to graphics Copyright laws as they pertain to the Internet, however, aren’t as clear. For example, a server in another country might host a Web site, which could mean it’s regulated by copyright laws in that country. Because each country has its own copyright laws, enforcement can be difficult. Contrary to what some might believe, there’s no international copyright law. The U.S. Copyright Office identifies what can and can’t be covered under copyright law in the United States: Copyright protects “original works of authorship” that are fixed in a tangible form of expression. The fixation need not be directly perceptible so long as it may be communicated with the aid of a machine or device. Copyrightable works include the following categories:

1. literary works;

2. musical works, including any accompanying words;

3. dramatic works, including any accompanying music;

4. pantomimes and choreographic works;

5. pictorial, graphic, and sculptural works;

6. motion pictures and other audiovisual works;

7. sound recordings;

8. architectural works.

These categories should be viewed broadly. For example, computer programs and most “compilations” may be registered as “literary works”; maps and architectural plans may be registered as “pictorial, graphic, and sculptural works.” Anything that would ordinarily be copyrighted through noncomputer means and is now being created on digital media is considered to be copyrighted, as long as the process for obtaining a copyright has been followed. Digital watermarks can be visible or imperceptible in media such as digital photos or audio files. Visible watermarks are usually an image, such as the copyright symbol or a company logo, layered on top of a photo. Imperceptible watermarks don’t change the appearance or sound quality of a copyrighted file. Methods used for imperceptible watermarks sometimes involve modifying a file’s LSBs into a unique pattern.