Week 3 - Understanding Data: Extra-2 - BMP File Structure Investigation

Learning Objectives

• Investigate the structure of BMP files.
• Analyse an image file structure through a Hex Editor.

Employability Skill Objectives

• Use a Hex Editor tool such as HxD to investigate file structure.

Introduction

The purpose of this lab is to familiarise students with the concept of data structure and how data is laid out and stored in computers.
A data structure is divided into fields, and each field has a name and a defined size.

For example, in a BMP file structure, the first field provides the file signature and has a length of 2 bytes.
In this lab, students will analyse a BMP image to extract information such as image size, height, width, and related metadata.

Cyber Lab Shared Folder All required files are available in the CyberLab shared folder.

1. Open File Explorer.
2. In the address bar, type \\cyberlab and press Enter.
3. If prompted for login details, use:
   Username: student
   Password: Student4
4. Navigate to Cyber Share , then Digital Forensics – Ali Jaddoa Folder.

Setup

You will need a Hex Editor such as:

• Login to you PC, username:Student, password student2
  • in case you need admin permmission, please let me know.
• You can use eitherof the follwing
  • HxD Hex Editor (desktop version), and it should be alreadu intalled on your pc.
  • HexEd.it (online version).

Task 1 - Study Basic BMP Data Structure

The bitmap file structure consists of three core sections:

1. BITMAPFILEHEADER
2. BITMAPINFOHEADER
3. BITMAPDATA

Table 1 details the structure of each section and defines the offset, size and description of data fields. All integer values are stored in little-endian format.

Table 1: BMP File Structure Example

Sources:

• Microsoft Documentation

Steps

1. Use this filecat.bmp that

   • you can download from here,
   • Or from Moodle-Week 3
   • Or from the Shared Folder in your local machine.

2. From Moodle → Week 3 → Lab 2 Lab-2 BMP File Structure, download cat.bmp and save it to your folder. or you can download from here

3. Open HxD Hex Editor

4. Open cat.bmp in the Hex Editor.

5. Use the above table to answer the following questions:

Task 2 - Answer the Following Questions

1. If a .bmp file is opened in a hex editor (using the Windows BITMAPINFOHEADER format), at what offsets (in hex) can the width and height of the image be found?

2. Consider the following hex values (first 36 bytes from a bitmap file):

   42 4D 16 94 04 00 00 00 00 00 36 00 00 00 28 00 00 00

   90 01 00 00 FA 00 00 00 01 00 18 00 00 00 00 00 E0 93

   04 00 13 0B 00 00 13 0B 00 00 00 00 00 00 00 00 00 00

   

   • Assuming that the file uses the Windows BITMAPINFOHEADER format, what is the hexadecimal value at offset 12h (size: one byte) ?

3. Using the same data above:

   • At offset 0h, what is the file signature (2 bytes) for a BMP image?

4. The digital world (data, structures, and information) is constructed of binary.

   • How many symbols are used to represent binary?
   • How many states can the symbols represent?

5. The digital world is also represented in hexadecimal.

   • How many symbols are used to represent hexadecimal?
   • How many binary digits are used to represent each hexadecimal symbol?

6. The digital world (data, structures, and information) is also constructed of bytes.

   • How many bits are in a byte?
   • How many decimal values can be represented with 8 bits?
   • What is the maximum decimal value representable using 8 bits (starting count from zero)?

---