Question

1. What metadata can you find from image files, e.g. jpeg or jpg, bmp, TIFF etc. How can the metadata be helpful in Digital Forensics? Please retrieve the metadata from some photos you have and submit these photos and your answer.

2. Please briefly describe NTFS alternate data streams (ADSes).

Answer 1

METADATA FOR IMAGE FILES :

• TIFF (.tif, .tiff)

Tagged Image File Format are lossless pictures documents implying that they don't have to pack or lose any picture quality or data (despite the fact that there are possibilities for pressure), considering great pictures yet additionally bigger record sizes.

• JPEG (.jpg, .jpeg)

It which represents Joint Photographic Experts Groups and is a "lossy" design implying that the picture is packed to make a more modest document.

• PNG(.png)

It means "Portable Graphics Format". It is the most utilized uncompressed raster picture design on the web. This lossless information pressure design was made to supplant the Graphics Interchange Format.

HELP TO DIGITAL FORENSIC:

• It is valuable much of the time, where it can give cooperation proof between gatherings of individuals, as some of them don't know about what sort of data is put away in their archive.
• Subsequently, the computerized legal agent can get to the data in this shrouded record.
• It regularly considers meaningful proof.
• For instance, remarks in a Word report can show the drafter's aim.
• Further, it is incredibly valuable for verifying proof since it regularly shows the creator and creation date for records. Advanced photos frequently incorporate GPS arranges

EXAMPLES OF METADATA OF PHOTOS:

2. Alternate Data Streams (ADS) are a file attribute only found on the NTFS file system. It simply contains text inside the text file. But it is only the primary data stream. This attribute is sometimes called an anonymous data stream since the name string is empty. So any data stream that has a name is considered alternate. The data stream has been abused to write to suffer from a bad reputation is because of their hidden data.