|
|
| Line 1: |
Line 1: |
| − | The '''Graphics Interchange Format''' ('''GIF''') (SM) format is a lossless [[image format]]. GIF images use internal [[LZW]] compression to reduce file size. CompuServe created this format, which is a bitmap image format allowing 256 different colors to be selected from a 24-bit color palette (RGB). GIF also allows for animations by sequencing through multiple GIF image data inside a single file.
| + | This page describes large-scale corpora of forensically interesting information that are available for those involved in forensic research. |
| | | | |
| − | "The Graphics Interchange Format(c) is the Copyright property of CompuServe Incorporated. GIF(sm) is a Service Mark property of CompuServe Incorporated."
| + | =Disk Images= |
| | | | |
| − | == Format == | + | =Email messages= |
| | | | |
| − | GIF files consist of a [[header]], image data, optional [[metadata]], and a [[footer]]. The header consists of a signature and a version, each 3 bytes long. The signature is <tt>47 49 46</tt> (hex) / <tt>GIF</tt> (text). The versions are either <tt>38 37 61</tt> or <tt>38 39 61</tt> (hex) / <tt>87a</tt> or <tt>89a</tt> (text) respectively. The footer or trailer (as identified in the format specification) is usually <tt>3B</tt> (hex).
| + | =Log files= |
| − | | + | |
| − | Common file extensions are .gif and .GIF
| + | |
| − | | + | |
| − | == Metadata == | + | |
| − | | + | |
| − | GIF89a files can contain [[metadata]] in [[text]] format. GIF metadata is contained in sections identified as a Comment Extension, a Plain Text Extension, and an Application Extension. All extension sections begin with the Extension Introducer <tt>21</tt> (hex).
| + | |
| − | | + | |
| − | Comment Extensions are optional and more than one may be present. They were designed to allow including comments about the graphic, credits, descriptions or other types of non-control/non-graphic data. The beginning of this block has the Extension Introducer and a Comment Label <tt>FE</tt> (hex). Comment data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data. Comment Extensions should appear either before or after the control and graphic data blocks.
| + | |
| − | | + | |
| − | Plain Text Extensions are optional and more than one may be present. They were designed to allow rendering of textual data as a graphic. The beginning of this block has the Extension Introducer and a Comment Label <tt>01</tt> (hex). Plain text data has a sequence of sub-blocks between 1 and 255 bytes in length, with the size in a byte before the data.
| + | |
| − | | + | |
| − | Application Extensions are optional. They were designed to allow applications to insert application specific data inside a GIF. The beginning of this block has the Extension Introducer and an Application Extension Label <tt>FF</tt> (hex).
| + | |
| − | | + | |
| − | == External Links ==
| + | |
| − | | + | |
| − | * [http://en.wikipedia.org/wiki/GIF Wikipedia: GIF]
| + | |
| − | * [http://www.w3.org/Graphics/GIF/spec-gif89a.txt W3.Org: GRAPHICS INTERCHANGE FORMAT SPECIFICATION]
| + | |
| − | | + | |
| − | [[Category:File Formats]]
| + | |
Revision as of 22:17, 3 February 2007
This page describes large-scale corpora of forensically interesting information that are available for those involved in forensic research.
Disk Images
Email messages
Log files
