Exam 312-49v10 topic 1 question 774 discussion

In the scenario where a Computer Hacking Forensic Investigator (CHFI) is examining a suspicious PDF document for hidden data leaks and has discovered unexpected objects in the file’s body, the most appropriate next step would be: C. Examine the cross-reference table (xref table) for any unusual links to objects Explanation: The cross-reference table (xref table) in a PDF file contains references to all the objects within the PDF, inclu ding their locations. Examining the xref table can help identify any unusual or unexpected links to embedded objects, which may indicate hidden data or steganographic techniques being used to leak information.

The first bits of a file represent the file type, and JPEG files start with the binary value 0xffd8 (start of image; SOI) and end with the binary value 0xffd9 (end of image; EOI). Therefore, ffd8 (the 0x is implied) at the beginning represents a JPEG file when viewed with a hex editor.