Difference between pages "GIF" and "Forensic corpora"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
m
 
Line 1: Line 1:
The '''Graphics Interchange Format''' ('''GIF''') (SM) format is a lossless [[image format]].  GIF images use internal [[LZW]] compression to reduce file size.  CompuServe created this format, which is a bitmap image format allowing 256 different colors to be selected from a 24-bit color palette (RGB).  GIF also allows for animations by sequencing through multiple GIF image data inside a single file.
+
This page describes large-scale corpora of forensically interesting information that are available for those involved in forensic research.
  
"The Graphics Interchange Format(c) is the Copyright property of CompuServe Incorporated. GIF(sm) is a Service Mark property of CompuServe Incorporated."
+
=Disk Images=
  
== Format ==
+
=Email messages=
  
GIF files consist of a [[header]], image data, optional [[metadata]], and a [[footer]]. The header consists of a signature and a version, each 3 bytes long.  The signature is <tt>47 49 46</tt> (hex) / <tt>GIF</tt> (text).  The versions are either <tt>38 37 61</tt> or <tt>38 39 61</tt> (hex) / <tt>87a</tt> or <tt>89a</tt> (text) respectively.  The footer or trailer (as identified in the format specification) is usually <tt>3B</tt> (hex).
+
=Log files=
 
+
Common file extensions are .gif and .GIF
+
 
+
== Metadata ==
+
 
+
GIF89a files can contain [[metadata]] in [[text]] format.  GIF metadata is contained in sections identified as a Comment Extension, a Plain Text Extension, and an Application Extension.  All extension sections begin with the Extension Introducer <tt>21</tt> (hex).
+
 
+
Comment Extensions are optional and more than one may be present.  They were designed to allow including comments about the graphic, credits, descriptions or other types of non-control/non-graphic data.  The beginning of this block has the Extension Introducer and a Comment Label <tt>FE</tt> (hex).  Comment data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data.  Comment Extensions should appear either before or after the control and graphic data blocks.
+
 
+
Plain Text Extensions are optional and more than one may be present.  They were designed to allow rendering of textual data as a graphic.  The beginning of this block has the Extension Introducer and a Comment Label <tt>01</tt> (hex).  Plain text data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data.
+
 
+
Application Extensions are optional. They were designed to allow applications to insert application specific data inside a GIF. The beginning of this block has the Extension Introducer and an Application Extension Label <tt>FF</tt> (hex). 
+
 
+
== External Links ==
+
 
+
* [http://en.wikipedia.org/wiki/GIF Wikipedia: GIF]
+
* [http://www.w3.org/Graphics/GIF/spec-gif89a.txt W3.Org: GRAPHICS INTERCHANGE FORMAT SPECIFICATION]
+
 
+
[[Category:File Formats]]
+

Revision as of 22:17, 3 February 2007

This page describes large-scale corpora of forensically interesting information that are available for those involved in forensic research.

Disk Images

Email messages

Log files