A Computer Hacking Forensic Investigator (CHFI) is trying to identify a hidden data leak happening through seemingly benign PDF documents sent from a corporate network. While examining a suspicious PDF, he discovers a series of unexpected objects in the file’s body. Given the following hex signatures of various file formats: JPEG (0xffd8), BMP (0x424d), GIF (0x474946), and PNG (0x89504e), which of the following actions should he take next?

A. Search for the existence of the hex signature 0x89504e in the PDF's body as a PNC could be embedded

B. Check for the existence of the hex signature 0xffd8 in the PDF's body as a JPEG could be hidden

C. Examine the cross-reference table (xref table) for any unusual links to objects

D. Verify if the PDF document ends with the %EOF value








 

Suggested Answer: B

Community Answer: B



This question is in 312-49V10 EC-Council Computer Hacking Forensic Investigator (CHFI) v10 Exam
For getting EC-Council Computer Hacking Forensic Investigator (CHFI) Certificate







Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by EC-Council. 
Trademarks, certification & product names are used for reference only and belong to EC-Council.
The website does not contain actual questions and answers from EC-Council's Certification Exams.