Chapter 7 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. Commit to an answer before you scroll.

Multiple choice

Q1. What does file carving fundamentally do? - A) Reads the $MFT to follow cluster runs to a file's data - B) Scans the raw bytes of an image for known headers and footers, ignoring the file system entirely - C) Rebuilds the partition table from backup GPT structures - D) Replays the file-system journal to reverse a deletion

Q2. What is the safest generic JPEG header, and its footer? - A) Header FF D9, footer FF D8 - B) Header FF D8 FF, footer FF D9 - C) Header 89 50 4E 47, footer 49 45 4E 44 AE 42 60 82 - D) Header 25 50 44 46, footer 25 25 45 4F 46

Q3. The signature 50 4B 03 04 at the start of a file means the file is: - A) a PDF - B) a PNG image - C) a ZIP container — and therefore possibly a DOCX, XLSX, PPTX, JAR, APK, ODT, or EPUB - D) an MP4 video

Q4. Which of these formats has no reliable footer, forcing header-and-maximum-size carving? - A) PNG - B) GIF - C) JPEG - D) MP4 / MOV

Q5. The "nested footer" problem causes a naive JPEG carver to: - A) merge two unrelated files into one - B) stop at the embedded EXIF thumbnail's FF D9 and truncate the real photograph - C) skip the file's header entirely - D) write a single multi-gigabyte file

Q6. What is the single biggest reason linear carving fails on large, valuable files such as video and PST email stores? - A) False positives from short signatures - B) Fragmentation — the file's bytes are not stored contiguously - C) Encryption of the file system - D) The files have no header

Q7. "Smart carving" / object validation means: - A) trusting the file extension to set the type - B) pairing each candidate carve with a format-specific validator that confirms internal structure and computes the exact length - C) hashing every carved file after the run - D) carving only the allocated regions of the disk

Q8. Which tool validates files as it carves, producing far cleaner output, and is the default first choice for recovery? - A) Foremost - B) Scalpel - C) PhotoRec - D) dd

Q9. A carved file, by definition, lacks which of the following? - A) Any internal metadata such as EXIF - B) File-system metadata — its original name, folder path, owner, and NTFS MACB timestamps - C) A recognizable header - D) Recoverable image data

Q10. Which is the correct documentation set to make a carve defensible in court? - A) The original filename, folder path, and owner - B) The source-image hash, the tool name/version/configuration, the byte offset of each file, and a hash of each carved output - C) The per-file hash alone - D) The file extension assigned by the carver

True / False

Q11. On a TRIM-enabled SSD, carving the unallocated space shortly after a file is deleted reliably returns that file. (True / False)

Q12. A carved JPEG's internal EXIF DateTimeOriginal is a file-system timestamp that proves when the file was saved to the drive. (True / False)

Short answer

Q13. In one or two sentences, explain why "found a ZIP (50 4B 03 04)" is not the same as "found a DOCX," and what specifically confirms that a given ZIP is an Office document.

Q14. Name the four tools the chapter centers on and, in a few words each, what each is best at.

---

Answer key

Q1 — B. Carving reads raw bytes for the shape of files — headers and footers — with no file system involved, which is exactly why it works when the $MFT, FAT chain, or inode table is gone. (A, C, and D are metadata- or structure-based techniques from Chapter 6.)

Q2 — B. FF D8 FF is the safest generic JPEG header (the fourth byte, E0/E1, distinguishes JFIF from Exif); FF D9 is the EOI footer. PNG and PDF in C and D are real signatures but belong to other formats.

Q3 — C. 50 4B 03 04 ("PK\x03\x04") is a ZIP local file header. Modern Office files, OpenDocument, JAR, APK, and EPUB are all ZIP underneath, so the signature alone cannot tell you which — you must look inside.

Q4 — D. MP4/MOV has no fixed terminating byte sequence; you carve it by maximum size and rely on internal box sizes. PNG, GIF, and JPEG all have reliable footers.

Q5 — B. Most phone photos embed a small JPEG thumbnail with its own FF D8 FF and FF D9. A carver that stops at the first FF D9 ends at the thumbnail and truncates the real image; structure-aware parsing of the markers avoids it.

Q6 — B. Fragmentation breaks the contiguity assumption every linear carver makes. Garfinkel found large, often-rewritten types — JPEGs (~16%), Word docs, and especially PST stores (>50%) — fragment most, so carving fails worst on the most valuable files.

Q7 — B. Object validation pairs each candidate with a validator that understands the format, confirming the bytes really decode and computing the true length — killing false positives, fixing the nested-footer bug, and enabling fragment-reassembly tests.

Q8 — C. PhotoRec carries format-specific knowledge for hundreds of families and validates as it goes, so its output is far cleaner than the pure signature scans of Foremost and Scalpel. dd is an imaging tool, not a carver.

Q9 — B. A carved file has no file-system metadata — that metadata is precisely what was gone when you resorted to carving. It can still have internal metadata (EXIF), a header, and good data; it just has no name, path, owner, or MACB timestamps.

Q10 — B. Defensibility comes from reproducibility: the hash-verified source, the exact tool/version/config, the offset of each file, and a hash of each output. A and D claim metadata the carve never had; C alone is not enough to reproduce the result.

Q11 — False. TRIM tells the SSD controller the deleted blocks are free, and the controller zeroes them in the background, often within seconds. Carving a TRIM'd SSD after a delete frequently returns nothing. (Chapter 9.)

Q12 — False. EXIF is internal metadata that rides inside the file, not file-system metadata. It survives carving precisely because it is internal — but it can be edited, and it says nothing about when the file system saved the file. Treat it as corroborating, not conclusive.

Q13 — Model answer. 50 4B 03 04 is a generic ZIP container signature, and DOCX, XLSX, PPTX, JAR, APK, ODT, and EPUB all begin with it — so the signature alone cannot identify the format. You confirm an Office Open XML document by looking inside the archive for [Content_Types].xml (and members such as word/document.xml for Word).

Q14 — Model answer. PhotoRec — validate-as-you-go recovery, the cleanest output, the default first carver. Foremost — a transparent, configurable signature carver whose audit.txt (with versions, invocation, and per-file offsets) is report-ready. Scalpel — a fast, configuration-driven signature carver with a REVERSE "last footer" option. bulk_extractor — a feature scanner that pulls emails, URLs, credit-card numbers, and EXIF/GPS out of fragments too small to carve as files.

Scoring: 13–14 correct — you have both the signatures and the discipline; carve on to Chapter 8. 10–12 — solid; revisit smart carving and the documentation standard (Q7, Q10) and the footer-reliability table (Q4). 7–9 — re-read "Three ways to carve" and "The fragmentation problem," then retake. Below 7 — work the chapter's wedding-photos worked example end to end against a practice image; carving files whose true contents you already know teaches what the prose alone did not.