Chapter 8: File Signature Analysis and Hash Analysis
1. D. A signature analysis will compare a file’s header or signature to its file extension.
2. A. A file header identifies the type of file and is located at the beginning of the file’s data area.
3. C. The Windows operating system uses a file’s extension to associate the file with the proper application.
4. B. Unix (including Linux) operating systems use a file’s header information to associate file types to specific applications.
5. D. When determining which application to use to open a file, Mac OS X gives first precedence to “user defined” settings, second precedence to creator code metadata, and third precedence to filename extensions. If none of these are present, other rules come ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
