One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

The file header is the initial section of a file's data that contains metadata about the file format. This metadata includes a specific sequence of bytes known as a "magic number" or file signature, which uniquely identifies the file type. Forensic investigators and software applications read this header to determine the true nature of a file, irrespective of its user-assigned extension. For instance, a JPEG file will always begin with the hexadecimal signature FF D8 FF, allowing an investigator to identify it as an image file even if it is renamed with a .doc extension.

A. the File Allocation Table: This is a filesystem index that points to the physical location of file data on a disk; it does not contain information about the file's format.
C. the file footer: While some file formats have a footer (end-of-file marker), the header contains the primary, standardized signature for type identification.
D. the sector map: This is a low-level representation of data storage on a disk and is not related to the internal structure or format of a specific file.

1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "File Type Analysis," Section "Signature-Based," Carrier states, "The basic idea of this technique is to compare the first few bytes of a file with a database of signatures for known file types." (p. 229).

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. Chapter 9, "Processing Digital Crime Scenes," explains that file type identification is performed by examining file headers for known signatures, noting that this is more reliable than trusting file extensions (pp. 298-299).

3. Garfinkel, S. L. (2007). Carving contiguous and fragmented files with fast object validation. In Proceedings of the 2007 DFRWS Conference. DFRWS. Section 2.1, "File Headers, Footers, and Structure," describes how file carving and identification rely on recognizing the "magic numbers" located in file headers. https://doi.org/10.1016/j.diin.2007.06.002