week 26 - forensics: digital data

Question 1

file signature ?

Answer 1

unique identifier - specifies what the data content on a file is

Question 2

MACE?

Answer 2

Modified, Accessed, Created, Entry Modified

Question 3

Exif?

Answer 3

Exchangeable Image File - standard that defines info about an image

Question 4

Physical image?

Answer 4

A physical image is a bit-for-bit replica of all the data contained on a digital device. Making a physical image will capture all live and deleted data.

Question 5

Logical image

Answer 5

A logical image contains all data that is visible to the file system of the device concerned. Deleted files and fragments will not normally be captured using this imaging method.