Chapter 20 — Further Reading

Media and document forensics rewards two habits: knowing the format specifications well enough to defend a finding byte by byte, and knowing the tools well enough to reach a result quickly. Start with the tool author's own documentation and one approachable explainer, then go to the primary format references when a finding is contested.

Foundations (🔬 deeper / format-level)

• CIPA DC-008, Exchangeable Image File Format for Digital Still Cameras (Exif). The actual EXIF specification — IFD structure, the 12-byte tag entry, type codes, and the full tag tables. When you must explain why DateTimeOriginal has no timezone or what a given tag ID means, this is the source.
• ISO/IEC 14496-12, ISO Base Media File Format (ISOBMFF). The box/atom structure shared by MP4, MOV, and HEIC, including ftyp, moov, and the mvhd/tkhd/mdhd headers with their 1904-epoch times. The Library of Congress sustainability format pages summarize it approachably.
• ECMA-376 / ISO 29500 (OOXML) and the \[MS-CFB\] Compound File Binary specification. The first defines the DOCX/XLSX/PPTX ZIP-and-XML structure (core.xml, app.xml); the second defines legacy OLE .doc/.xls and its SummaryInformation streams.
• Adobe, PDF 32000-1 (the PDF specification). Objects, the xref table, the trailer, /Info, XMP, and — critically — incremental updates. The mechanism behind every "redaction failure" and surviving prior revision is documented here.

Approachable explanations (everyone)

• Phil Harvey, the ExifTool documentation and tag-name index (exiftool.org). The single most useful reference for this chapter: every tag, every format, and the exact syntax for reading, writing (to demonstrate editability), and extracting thumbnails. Bookmark the tag index.
• Neal Krawetz, the Hacker Factor blog and FotoForensics tutorials ("A Picture's Worth…"). The clearest plain-language treatment of ELA, JPEG quantization, and why these tools are routinely overinterpreted. Read the cautions as carefully as the techniques.
• MediaInfo documentation (mediaarea.net). What each container/codec/encoder field means, and how to read an "encoded date" and a "writing library" as forensic signals.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 ExifTool + FotoForensics / Forensically (29a.ch). The working pair for metadata and first-pass manipulation analysis; Forensically adds clone detection, noise analysis, and a magnifier alongside ELA.
• 🛡️ binwalk, zsteg, stegdetect, steghide, and StegExpose. The detection stack for appended data, LSB embedding, and JPEG-coefficient stego — for the responder hunting exfiltration hidden in images.
• 📜 oletools (Philippe Lagadec), Apache Tika, qpdf, mutool, peepdf, and pdftotext. The document/PDF examiner's kit: dump OOXML and OLE metadata, flatten PDF incremental updates, and surface text from beneath "redactions" for an eDiscovery production.
• 💾 photorec/scalpel + exiftool -b -ThumbnailImage. Carve damaged JPEGs, then rescue the embedded thumbnail and re-index orphans by DateTimeOriginal/Model/GPS — the workflow behind Case Study 1.

Reference (this book)

• Appendix A — File Signatures Reference: the magic numbers (JPEG FF D8 FF, PNG, ZIP PK 03 04, OLE D0 CF 11 E0, %PDF, ftyp, RIFF) behind every format in this chapter.
• Appendix H — Command-Line Reference: the full exiftool option set, plus xxd, binwalk, and the PDF tools.
• Appendix B — Python Forensics Toolkit: the GPS-DMS and 1904-epoch conversions, scriptable for batch work.
• Chapter 7 — File Carving, Chapter 19 — Email, Chat, and Social Media Forensics, Chapter 21 — Timeline Analysis, and Chapter 35 — AI-Assisted Forensics and Deepfakes: the surrounding workflow.

Do, don't just read

• Parse one EXIF block with your own eyes. On a practice phone photo (Appendix J), run exiftool -htmlDump and find the FF E1 / "Exif\0\0" / II* sequence by hand; then convert its GPS to decimal degrees and reconcile the local time against the GPS-UTC stamp to recover the timezone. You do not understand EXIF until you have walked one IFD entry yourself.
• Break a "redaction," then build a finding. Take a PDF with a black-box "redaction," recover the text with pdftotext, and count %%EOF markers to see the revisions. Then, on a separate image, reproduce the Case Study 2 mistake — declare manipulation from a glowing ELA map — and dismantle your own sentence the way the independent examiner did. Feeling the overstatement collapse once teaches the limits better than any list.

Next: Chapter 21 — Timeline Analysis: fuse the EXIF, document, file-system, registry, and log timestamps into one super-timeline — and let the contradictions, including timestomping, tell you what really happened.