Copy Digital Signature Evidence with airSlate SignNow

Analyze signature document

welcome to a segment and file signature analysis and the digital forensics series in this segment we'll take a look at how to analyze files and their signatures to identify the appropriate file type that file actually is originally was or now has been changed to hide data we'll assume that we're in a forensic analysis ition your department has retrieved the criminals machine and has done a full harddrive imaging process so that were only working with verified copied of the files and not the originals so the department is known to have been struggling to identify a group of files and these particular group of files have not been accessible or are showing up as corrupted files so our job is to see if the files are actually corrupted of the criminal has somehow modified the file types to prevent access into this data so now remember that in a Windows operating system that I've had my view changed to showing file type filename extension so you can see that these are just called file one without any extensions and in Windows OS if a file extension has changed in any way this will alter the file drastically it could potentially make the file unreadable this is because Windows OS will take into account the file extension to make the file accessible and allow it to be opened with the appropriate application depending on its extension so if it was a dot doc it'll automatically look for a word processing application of the words the doc takes to automatically open a text editor if it was a jpg or automatically open it with the image viewer or paint or any sort of imaging program so to categorize it in that kind of manner so when we remove or change the extension the windows always will think that this file is now something entirely new and we know for a fact that there are many file types that could be a possible solution or we could spend countless hours checking each different file type and trying it out or we could try the most common file for a faster result but none of these methods are still efficient enough so what we can do is we can use file signatures which I explained in the segment to aid with our restoration process of the unreadable files so we'll analyze the files using hex editor and analyze the header and trailer of these files to identify what their type is so each file will have a hidden trailer which is unique to itself and it will identify what type of file that particular file is it regardless of you changing the extension so if I were to say file dot txt it won't matter like it will windows always will read it as a text file but other operating systems will use this particular unique hitter and trailer to identify particular type this filer so we'll use that parents did...