W6 03092018 Mon

data recovery in forensics need to be carefully made that do not temper original state.

Different file extension may cause confusion in investigation. like psd for photoshop.

Also, raw graphic file may be overlooked as they don't have file extension.

jpeg and tiff include metadata(exif) with first 160 bytes.

In editing or viewer have list of recent files that may give extra information about intentional act.

File header and footer is unique in different file extension and doesn't change.

Setting up maximim file size in scalpel  is important when carving data from fragmented files.

even the file extension changed, the file header isn't change at all.