What can an investigator examine to verify that a file has the correct extension?

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document.

What can an investigator examine to verify that a file has the correct extension?
A . the File Allocation Table
B. the file header
C. the file footer
D. the sector map

View Answer

Answer: B