QuestionQ65

Digital Evidence

Michael, a forensic examiner, is performing a forensic analysis of an image file acquired from a suspect’s machine. While reviewing the file with a hex editor, he finds that its hexadecimal value begins with the sequence 89 50 4e. The file seems suspicious, so Michael must identify its type to understand its structure and determine whether it contains malicious content. Given this information, what type of file is Michael examining?

  • A BMP
  • B PNG
  • C JPEG
  • D PDF
Explanation

A PNG file begins with the signature 89 50 4E 47 0D 0A 1A 0A; therefore, the observed opening bytes 89 50 4E identify the file as PNG.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!