Methods of Storing Data: Number Systems

A forensic analyst needs to quickly infer a file’s type from a raw memory dump. Which number system should they primarily use to interpret file signatures efficiently, and why?

• Binary, because it is the native language of hardware and represents data in bits.

• Decimal, because humans use it daily and file sizes are presented this way.

• Hexadecimal, because each symbol maps to four bits and forensic tools present signatures in hex.

• Octal, because it compactly represents three-bit groups common in legacy systems.

Each pair of hexadecimal digits (e.g., 57, 69) in the diagram represents which of the following?

• One byte of raw data

• Two bytes of raw data

• One bit of raw data

• A file header only

Strategically, why is viewing data in hexadecimal useful in cyber forensics?

• It reveals both printable and non-printable byte values directly

• It hides data from investigators

• It compresses files automatically

• It converts all data to images

Consider the first byte pair 57 shown at offset 00000000. What ASCII character does 0x57 correspond to?

• W

• G

• Q

• T

At offset 00000000 the sequence begins 57 69 6B. Interpreting these as ASCII, which word is most likely starting?

• Wik

• Wok

• Wac

• Wrc

In the sequence 61 2C appearing on the first line, what characters are represented?

• a,

• a.

• a:

• a;

If an investigator sees 29 21 at the end of the last line, what punctuation sequence is indicated in ASCII?

• )!

• !?

• ),

• !:

Which reasoning step helps validate that this hex dump encodes readable English text?

• Identify frequent ASCII letters (e.g., 65 for 'e', 20 for space) across the dump

• Expect all bytes to be above 0xF0

• Check that offsets are negative

• Assume binary-only content

What is the most likely character for 0x2C appearing after letters in the first line?

• Comma

• Colon

• Semicolon

• Period

To plan extraction of strings from raw hex, which tool operation is most effective?

• Use ASCII decoding on contiguous byte sequences

• Perform image steganography

• Apply lossy compression

• Replace all 0x00 with 0xFF