This file is an archive file — collection of files
packaged together as a single .zip file.
If, at this point, you go to your desktop and double-click on the
on the icon for
zip file will be opened for viewing. However,
the contents of the zip file have not yet
been extracted. To extract the contents, look for a link
at the top of the window that resulted from the double-clicking that says
Extract all files . Click on that, and choose to
put the files on your Desktop also.
Close both of the file-viewer windows that are open. And verify that you now have on your desktop an icon for
as well as the icon .
Activity_1_Documentsfolder on your desktop, open the file
Document_1.docxwith Microsoft Word by double-clicking on the file's icon. See what's there then exit Microsoft Word.
Document_1.docx. Now you're seeing what's really in the file, byte-by-byte. One interesting attribute of the
.docxformat that Microsoft introduced is evident in the first bytes of the file. The
.docxfile begins with
PK, or hex
50 4b, which is actually the same first two bytes as the zip file format. Verify this by opening
Document_4.zipin Frhed. These first few bytes are called the file's header.
Document_1.zip— do this by returning to your Desktop (or whatever location you saved Document_1.docx at), right-clicking on the name
Document_1.docx, selecting "Rename," and changing the file's name to Document_1.zip. Windows will offer a warning, but yes, you do intend to change the file extension!
Document_1change from the Word icon to a zip file icon. This is the normal behavior for windows: the icon you see depends only on the extension, i.e. on the name of the file. Now double click the Document_1.zip and see if it will open. Did it? What does this mean?
So, in fact, Microsoft uses the zip file format for their .docx, .xlsx, .pptx, formats. This knowledge is useful in the forensics world!
Document_2.pdf, which is a file in Portable Document Format. The header (first few bytes) for these files is always
25 50 44 46. Verify this for
Document_2.pdf. How can you verify this?
Document_3.txt. Does there appear to be a header for this text file? What can you do to try to verify this?
Unknown_1.txt. Does Windows think it is a text file? Is it actually a text file? Use the list below to determine the correct extension, rename the file appropriately, and open it up by double-clicking in order to see the files data in a meaningful way.
Unknown_2. It has no extension, so Windows is very confused. However, if you open it up, you should still see an organization of data into information. Use the list below to determine the correct extension and fix the file!
|⇦ available on resources page!|