The image file used for analysis is publicly available for download at http://dftt.sourceforge.net/.
The file we will be working with is JPEG Search Test #1 (Jun '04), as shown in the following screenshot:
This image contains several files with changed extensions and other files within them, as seen in the following download description:
Be sure to note the location of the downloaded sample file, as this will be required later on.
When investigating hard drives and devices, be sure to always follow proper acquisition procedures and use a pre-tested write-blocker to avoid tampering with original evidence.
When investigating hard drives and devices, be sure to always follow proper acquisition procedures and use a pre-tested write-blocker to avoid tampering with original evidence.