Computer Hacking Forensic Investigator (CHFI v10) — Question 537

Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

Answer options

• A. ff d8 ff
• B. 25 50 44 46
• C. d0 0f 11 e0
• D. 50 41 03 04

Correct answer: A

Explanation

The correct answer is A, as the hex code 'ff d8 ff' signifies the start of a JPEG file, which is a common image format. Options B, C, and D represent other file types: B is for PDF files, C is not associated with typical image files, and D corresponds to a different file format, not images.