Chapter 20 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. Commit to an answer before you look — and for every "this proves X" option, ask whether the metadata could have been edited or stripped first.

Multiple choice

Q1. Inside a JPEG's EXIF block, the first two bytes of the TIFF header are 49 49 ("II"). What do they tell you? - A) The image is interlaced - B) Every multi-byte value in this TIFF block is little-endian (Intel byte order) - C) The file has been edited in an image editor - D) The image is 49 × 49 pixels

Q2. Which EXIF timestamp records the moment the shutter fired — the time you usually mean by "when was this photo taken?" - A) ModifyDate (0x0132) - B) CreateDate / DateTimeDigitized (0x9004) - C) DateTimeOriginal (0x9003) - D) GPSDateStamp (0x001D)

Q3. A .docx, .xlsx, or .pptx file is, underneath, what kind of file — and what are its first bytes? - A) A proprietary binary blob; D0 CF 11 E0 - B) A plain-text XML file; <?xml - C) A ZIP archive of XML parts; 50 4B 03 04 (PK\x03\x04) - D) A PDF wrapper; %PDF

Q4. A PDF "redaction" consists of solid black rectangles drawn over a name and a dollar figure. What is most likely true? - A) The text under the boxes was permanently deleted - B) The text under the boxes is frequently still in the byte stream and recoverable with pdftotext/mutool/strings - C) The boxes encrypt the text beneath them - D) The boxes are part of the image and carry no text

Q5. You count the %%EOF markers in a single PDF file and find three. What does that indicate? - A) The file is corrupt - B) The PDF has three pages - C) The PDF has been saved through (about) three revisions via incremental updates, and earlier revisions may still be present - D) Three different authors signed the file

Q6. In an Error Level Analysis (ELA) result, a bright patch most reliably indicates: - A) Proof that the region was pasted in and the image is fake - B) A region with a different compression history than its surroundings — a lead to investigate, not proof of tampering - C) The brightest part of the original scene - D) The location of the EXIF block

Q7. The small second copy of a picture stored in a JPEG's IFD1 (the embedded thumbnail) is forensically useful because: - A) It is always higher resolution than the main image - B) Editors regenerate it perfectly every time, so it confirms authenticity - C) Editors often update the main image but forget the thumbnail, so a thumbnail that differs from the visible picture is direct evidence of post-capture editing - D) It contains the camera's password

Q8. What is the essential difference between steganography and encryption? - A) Steganography hides the existence of a message; encryption hides only its content - B) Steganography is reversible; encryption is not - C) They are the same thing - D) Encryption hides the existence of a message; steganography scrambles content

Q9. The creation_time in an MP4/MOV mvhd box is stored as seconds since which epoch? - A) January 1, 1970 UTC (Unix epoch) - B) January 1, 1601 UTC (Windows FILETIME epoch) - C) January 1, 1904 UTC (QuickTime epoch) - D) January 1, 2001 UTC (Apple Cocoa epoch)

Q10. A camera-original JPEG arrives in your case with no EXIF whatsoever. What is the most defensible interpretation? - A) The image is definitely forged - B) The image is definitely authentic - C) Absence of EXIF proves nothing about origin on its own — routine handling (e.g., social-media upload) strips it, so it is a question to corroborate, not an answer - D) The camera was broken

True / False

Q11. The presence of GPS coordinates in a photo's EXIF proves where the subject (or photographer) was physically standing. (True / False)

Q12. Most major social-media platforms (Facebook, Instagram, Twitter/X) strip EXIF metadata when an image is uploaded. (True / False)

Short answer

Q13. A photo's DateTimeOriginal is 2024:03:14 21:07:42 (local, no zone) and its GPSDateStamp/GPSTimeStamp are 2024:03:15 04:07:40 UTC. In one or two sentences, explain how these two fields together let you recover the timezone the photo was taken in, and state the recovered offset.

Q14. Name three distinct places in an OOXML (.docx) document where metadata can betray authorship or editing history, and state what each reveals.

---

Answer key

Q1 — B. 49 49 = "II" = little-endian ("Intel"); the alternative is 4D 4D = "MM" (big-endian, "Motorola"). The TIFF magic 42 that follows confirms the order. Read the order wrong and every multi-byte value is garbage.

Q2 — C. DateTimeOriginal (0x9003) is when the shutter fired. CreateDate/DateTimeDigitized is when the image was digitized (equal to Original on a digital camera), ModifyDate is last modification, and GPSDateStamp is a UTC date from the GPS receiver.

Q3 — C. OOXML files are ZIP archives of XML parts and media; the ZIP local-file-header signature is 50 4B 03 04. (D0 CF 11 E0 is legacy OLE/CFB Office; %PDF is a PDF.)

Q4 — B. Drawing a box over text does not delete the text; the bytes remain and surface with pdftotext, mutool, qpdf --qdf, peepdf, or even strings. Real redaction removes the bytes. This is the deleted ≠ destroyed theme applied to documents.

Q5 — C. PDFs are modified by appending a new body, xref, and trailer after the existing %%EOF (an incremental update; the new trailer's /Prev points back). Counting %%EOF markers approximates the revision count, and earlier revisions — including "removed" text and pre-filled form fields — often remain.

Q6 — B. ELA highlights regions whose compression history differs from their surroundings; that is a direction-finder, not proof. High-contrast edges, overlaid text, and inherently sharp regions also glow innocently, and a uniform recompression can mask real edits.

Q7 — C. The IFD1 thumbnail is a separate small JPEG. Many editors update the main image but not the thumbnail, so a mismatch (different crop or content) is direct evidence of manipulation. (It is also a recovery lifeline when the full image is corrupt.)

Q8 — A. Steganography conceals that a message exists at all (e.g., in LSBs or after FF D9); encryption conceals only the content while the ciphertext's existence is plain.

Q9 — C. MP4/MOV (QuickTime/ISOBMFF) dates count seconds from January 1, 1904 UTC — 2,082,844,800 seconds before the Unix epoch. Subtract that constant to get Unix time.

Q10 — C. Absence of EXIF is not evidence of forgery (presence is not evidence of authenticity, either). Social-media re-encoding, messaging-app recompression, and "Save As" all strip or rewrite EXIF, so a no-EXIF image must be corroborated, not pronounced on.

Q11 — False. GPS records "the location the device wrote into the file," which can be absent, imprecise (tens to hundreds of meters off on a poor or assisted fix), stale (a last-known fix), or forged. It is a strong lead requiring corroboration, never proof of where a person stood.

Q12 — True. Facebook, Instagram, and Twitter/X re-encode uploaded images and discard EXIF (partly for user privacy). This is why a downloaded social-media image legitimately has no metadata — and why absence proves nothing.

Q13. Both fields describe the same instant, but DateTimeOriginal is the camera clock in local time with no zone recorded, while GPSDateStamp+GPSTimeStamp are written by the GPS receiver in UTC. The difference between them is the UTC offset: local 21:07 on the 14th vs. UTC 04:07 on the 15th is a 7-hour gap, so the photo was taken in UTC−7 (e.g., Pacific Daylight Time) — provided the camera clock was correct.

Q14. Any three of: docProps/core.xml — dc:creator (original author) vs cp:lastModifiedBy (last saver), created/modified dates, revision count; docProps/app.xml — Application/AppVersion, Company, Template path, and TotalTime (cumulative editing minutes); word/document.xml + word/settings.xml — tracked changes (<w:ins>/<w:del> with w:author/w:date) and rsid revision-save IDs; word/comments.xml — reviewer comments with author and timestamp; word/media/ — embedded images carrying their own EXIF (capture time, software, GPS).

Scoring: 13–14 — courtroom-ready; you read metadata with both hands on the table and never overstate. 10–12 — solid; revisit the EXIF-timestamp set and the EXIF-as-evidence two-handed table. 7–9 — re-read "EXIF as evidence," "Document metadata," and "Detecting manipulation," then redo Groups C–E in the exercises. Below 7 — re-read the chapter index and rebuild the anchor-case findings table before moving on.