When will an "examination for finding pictures" be complete?

yunus · 2010-05-14T17:52:51Z

When you are required to find all pictures in an image file, a) you find all active and deleted pictures, b) you do "file signature analysis" and get those pictures with changed extensions,c) extract those inside compressed files like zip, rar, tar.gz…, d) and finally you do data carving for possible other pictures that might be included in word files and for those that were disguised by adding some hex values before the actual header and put into a form to look like some other type of file like .dat file.When you are done all these and have found all you can, do you think the examination is over or is there any other method left? I know there is stegoanalysis but I exclude it for now.Thanks

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by DecAnisimov 15 years ago

11 Posts

8 Users

0 Reactions

892 Views

RSS

DecAnisimov

(@decanisimov)

Active Member

Joined: 16 years ago

Posts: 11

22/05/2010 1:11 am

Thumbs.db or Thumbcache*.db ?

And many other

Exif thumbnails inside .jpg photos ?

Also thumbnails from following segments JFIF, JFXX, HPSC, H3X0, Adobe Resource and some another.

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
240 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed