Sophia, a forensic investigator, is analyzing a file suspected to be an image.

According to theCHFI v11 Computer Forensics FundamentalsandFile Analysismodules, identifying file types usingfile signatures (magic numbers)is a core forensic technique. File extensions can be easily manipulated by attackers as an anti-forensics tactic, so investigators rely onhexadecimal headersto determine the true file format.

The hexadecimal sequence47 49 46corresponds to the ASCII characters“GIF”. This signature appears at the beginning of allGraphics Interchange Format (GIF)files and is typically followed by version identifiers such asGIF87aorGIF89a. CHFI v11 explicitly lists GIF file headers as a common example when teaching file signature verification using hex editors.

For comparison:

PNGfiles start with the signature 89 50 4E 47

BMPfiles start with 42 4D (ASCII “BM”)

JPEGfiles typically start with FF D8 FF

Because the investigator observes 47 49 46 at the beginning of the file, this conclusively identifies the file as aGIF image, regardless of its filename or extension.

CHFI v11 emphasizes thathexadecimal signature analysisis essential when investigating disguised files, malware hidden as images, or data exfiltration attempts using file extension mismatch techniques.

Therefore, based on the file’s hexadecimal signature, the image format isGIF, makingOption Cthe correct answer.