Recovering Graphics Files Chapter

Recovering Graphics Files

• This chapter covers topics like computer graphics, data compression, locating and recovering graphics files, analyzing/repairing file headers, steganography, and copyrights.
• Steganography involves hiding data, including images, within files.
• Copyrights determine ownership of media (like images downloaded online) and the right to use that media.
• Graphic files contain digital photos, line art, 3D images, and scanned prints.
• Bitmap images are collections of pixels in a grid format.
• Vector graphics use mathematical instructions to define shapes like lines, curves, and ovals.
• Metafile graphics combine bitmap and vector formats.
• Graphics editors create, modify, and save bitmap, vector, and metafile graphics.
• Image viewers display graphics files but do not allow modification.
• There are various graphic formats (BMP, GIF, JPEG).
• Each format has differing qualities, including color and compression levels.
• Converting formats can alter image quality.
• Bitmap/raster images are grids of pixels, stored row-by-row, suitable for printing.
• Image quality is determined by screen resolution (pixel density), which depends on hardware and software.
• Higher resolution leads to sharper images.
• Monitors can display various resolutions; higher resolutions create sharper images.
• The more memory a video card has, the higher quality images it displays.
• Software drivers, especially those with low resolution, can degrade image quality when enlarged.
• Vector graphics files store calculations for shapes/lines, resulting in smaller files.
• Vector graphic files maintain quality when enlarged. 
• Metafile graphics combine raster and vector elements. 
• When enlarging a combination of graphics, vector areas remain sharper. 
• Standard bitmap formats include PNG, GIF, JPEG, TIF, TIFF, and BMP.
• Standard vector formats include HPGL, AutoCAD DXF, EPS (Encapsulated PostScript), WMF (Windows Metafile Format), and EMF (Enhanced Metafile Format).
• Standard graphics files are easier to use in digital forensics investigations.
• Analyzing a PNG header includes examining the chunk data length and type. 
• The structure of the PNG header shows chunk data length, a chunk type, chunk data itself, and a CRC chunk. 
• Carving/salvaging refers to recovering fragmented file parts.
• File slack is the space between a file’s end and the disk cluster boundary.
• Partially overwritten headers can be reconstructed by examining known header formats.
• Different file formats have specific header values (e.g., JPEG starts with FFD8).
• Tools like ProDiscover, X-Ways Forensics, EnCase, and FTK can help recover fragmented files and carve data from free space.
• To reconstruct file headers, analyze file headers to find known patterns and insert the needed values in hexadecimal format.
• Using tools like WinHex, identify new or unique header types.
• The internet is a resource for identifying unknown file types.
• Tools like ProDiscover and Exif Reader can capture and display metadata, aiding investigations.
• Digital watermarks hide content within a file, in bits of the graphic image and can be visible or imperceptible.
• Steganographic tools can locate hidden data within graphics files.

Understanding Digital Camera File Formats

• Digital camera files are important for evidence because they can be created by witnesses or suspects themselves.
• These files are mostly stored as either raw or EXIF format.
• RAW files preserve the best image quality.
• RAW files are typically proprietary, requiring specific viewing and conversion software from the camera manufacturer.
• Demosaicing converts raw image data to other formats.
• EXIF is a standard for storing metadata in JPEG and TIFF files, providing info about the camera, settings, and time.
• EXIF metadata retrieval needs specialized software like Exif Reader, IrfanView, or ProDiscover.

Understanding Data Compression

• Image formats, like GIF and JPEG, use compression to reduce files and transmission times. 
• BMP format does not use compression. 
• Compression typically codes large amounts of data into smaller forms.
• Lossless compression reduces a file without losing data (like GIF, PNG). 
• Lossy compression (JPEG) loses some data, aiming for optimal size trade-offs often.

Locating and Recovering Graphics Files

• Options include built-in operating system tools or better digital forensic tools that are designed for the tasks. 
• Use known file headers as a baseline for analysis. 

Identifying Graphics File Fragments

• Image files can be fragmented across a hard drive. Recover all fragments before re-creating and rebuilding the file.
• Carving or salvaging means recovering fragmented portions from free or slack space, via specialized digital forensics tool.

Repairing Damaged Headers

• Each file format has a distinct header.
• Compare the header with known examples to reconstruct and fix a file header.

Searching For and Carving Data from Unallocated Space

• A sequence of specific steps for finding and recovering image files, using tools like ProDiscover, recovering the clusters, and confirming or rejecting findings.

Rebuilding File Headers

• Open image files in viewing programs first to check for issues. Reconstruct a file header's values when there are file corruption problems. Determine the correct values, insert them into the file, and check for correct operation/viewing.

Reconstructing File Fragments

• Recovering fragmented image files may involve clustering, copying correct sequences of recovered clusters, and reconstructing the header to ensure proper display/viewing.

Identifying Unknown File Formats

• Encountering an unfamiliar file format requires analysis to identify the format to proceed with its viewing or reconstruction. 
• Researching an unknown file may be required via the internet.

Analyzing Graphics File Headers

• Analyze graphics file headers to detect unusual or new file types that common forensics tools may not recognize.
• Utilize hexadecimal editors (like WinHex) to examine hexadecimal values in the header. 
• This may involve research/comparison with samples in the internet.

Tools for Viewing Images

• Use image viewers to open image files. Multiple viewers increase efficiency in inspecting different formats.

Understanding Steganography in Graphics Files (Insertion and Substitution)

• Steganography hides data, typically text, inside images.
• Insertion hides data within the file format, usually invisible.
• Substitution replaces bits of an existing image to hide data, making only subtle changes to the original image.
• Tools and techniques are used to locate and decode hidden messages, often invisible to the viewer.

Understanding Copyright Issues with Graphics

• Digital watermarks/steganography methods used for copyright protection, including types of copyrightable material (literary, musical, pictorial).
• Legal considerations relating to the use of watermarks/images and copyright protection are discussed. 

Using Steganalysis Tools

• Analyze potential steganographic file structures using steganalysis tools, including hash value comparison to spot anomalies or duplication.