Before you investigate
by Froga
The ideas the Digital Forensics lab assumes: what a file signature is, what base64 does, how metadata hides in plain sight, and what a log line actually says. Ten minutes.
You're previewing this room. Log in or create a free account to answer the questions and track your progress.
Study material
A file extension is just a label the operating system trusts. The first few bytes of the file, called the magic bytes or file signature, are written by the program that created it. PNG always starts with 89 50 4E 47. Renaming it to .txt changes nothing inside.
A file is named "report.txt" but its first four bytes are 89 50 4E 47. What kind of file is it really?
multiple choice
AA plain text file, as the name says
BA PNG image
CA PDF document
DA ZIP archive
89 50 4E 47 spells .PNG in ASCII (after the first byte).
Log in to answer
Ready to test yourself?
Sign up free to answer, score points, and build your streak.