A printed photo was found on Alex's desk (see Exercise 01). The original digital copy is on file with IT, along with a recorded checksum used to confirm files haven't been altered. Your job: confirm whether the copy you've been given still matches what's on record — and if it doesn't, work out why. This is a basic introduction to digital forensics and file integrity checking.
Download the file below. It's a normal, safe photo.
↓ Download evidence_photo_04.jpgA checksum (or "hash") is a short fingerprint calculated from every byte in a file. Change even one byte, and the checksum comes out completely different. Use the tool below to calculate the SHA-256 checksum of the file you just downloaded, right in your browser — nothing is uploaded anywhere.
Once you find the hidden message, type the flag exactly as written (including the curly brackets) into the box below.
A JPEG image file has a defined ending point in its binary data (a marker called "End Of Image"). Programs that open photos stop reading at that point, so they never notice if extra data has been added after it — the picture still looks completely normal. But because a checksum is calculated from every single byte in the file, adding anything at all — even a few lines of hidden text — changes the checksum completely. That mismatch is exactly how real investigators first notice a file has been tampered with, often before they even know what was changed.
