Determine authentic file formats by parsing magic byte headers at offset 0. Instantly detect deceptive extension spoofing, inspect raw hex/ASCII headers, and carve disguised binaries with zero server upload.
Supports all formats (Executables, Disks, Documents, Archives, Media, Encrypted Volumes). Files of any size (even 50GB+) analyze in milliseconds because only the initial 128 bytes are sliced into volatile memory.
-
Browse or search 150+ file signatures used by forensic software to carve files.
| Extension | Hex Signature | ASCII / Magic | File Description | Category |
|---|
In computer science and digital forensics, a file signature (often termed magic numbers or magic bytes) is a distinctive sequence of binary bytes placed at the very beginning of a file (offset 0). When operating systems, compilers, or forensic carving software (such as Autopsy, EnCase, FTK, or Volatility) parse a file, they rely on these fixed hexadecimal markers to identify the file format, byte endianness, and structural encoding.
For instance, every Windows Portable Executable (including .exe, .dll, .sys, and .scr) initiates with the two hexadecimal bytes 4D 5A, which decodes in ASCII to the initials MZ (named after Mark Zbikowski, one of the original MS-DOS developers). Similarly, Adobe PDF documents strictly initiate with 25 50 44 46 (ASCII: %PDF), and standard PNG images initiate with the 8-byte signature 89 50 4E 47 0D 0A 1A 0A (ASCII: .PNG....).
Because standard desktop operating systems like Microsoft Windows hide known file extensions by default (e.g., displaying invoice.pdf.exe simply as invoice.pdf), cybercriminals and advanced persistent threat (APT) actors frequently use extension spoofing as a social engineering and delivery tactic:
Attackers name malware Report.docx.exe or Statement.pdf.scr. With default Windows settings, the user only perceives the trusted icon and docx/pdf suffix.
Naive perimeter email filters that check file extension strings rather than binary magic bytes allow dangerous executables disguised as .jpg or .txt to slip through.
Polyglot files combine valid headers from two distinct formats (e.g., a file that is simultaneously a valid ZIP archive and a valid GIF image) to confuse security inspection software.
During digital investigations where a suspect has formatted a storage drive, deleted evidence, or corrupted the Master File Table (MFT), forensic analysts perform file carving. Carving algorithms scan unallocated disk clusters byte-by-byte looking for recognized magic headers (e.g. FF D8 FF for JPEG) and corresponding trailers or footers (e.g. FF D9 for JPEG).
Understanding magic bytes empowers investigators to extract photos, emails, chat databases, and malware payloads directly from raw memory dumps (RAM) or disk images without needing a functional file system structure.
| Format | Magic Bytes (Hex) | ASCII | Investigative Context |
|---|---|---|---|
| Windows PE Executable | 4D 5A |
MZ |
Common in ransomware, loaders, DLL hijacking, and rootkits. |
| Linux ELF Executable | 7F 45 4C 46 |
.ELF |
Standard Linux malware, IoT botnets (Mirai), and server exploits. |
| Mach-O (macOS) | FE ED FA CE / CF FA ED FE |
- | Apple macOS and iOS executable binaries (32-bit / 64-bit). |
| EnCase Forensic Image | 45 56 46 09 0D 0A FF 00 |
EVF..... |
Standard forensic acquisition format (.E01) with embedded MD5 hashes. |
| PCAP Network Capture | D4 C3 B2 A1 / A1 B2 C3 D4 |
- | Packet captures from Wireshark, tcpdump, and network IDS sensors. |
| PCAPNG Capture | 0A 0D 0D 0A |
.... |
Next-generation Wireshark network capture container. |
| SQLite 3 Database | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 |
SQLite format 3 |
Used by WhatsApp, Chrome history, iOS SMS, Android call logs, Signal. |
| ZIP / Office 2007+ | 50 4B 03 04 |
PK.. |
PKZip archives, DOCX, XLSX, PPTX, APK, and JAR packages. |
FileReader API to slice the first 128 bytes in local browser memory. Zero network requests containing file data are generated, guaranteeing complete chain-of-custody privacy.
file.slice(0, 128), your browser does not load the gigabytes of data into RAM. Whether you drop a 500-byte shortcut or a 100-gigabyte .raw / .vmdk disk image, only the initial 128-byte header is extracted and decoded in under 5 milliseconds.
4D 5A MZ or 7F 45 4C 46 ELF), you should immediately treat the artifact as high-risk potential malware. Do not double-click the file on a host workstation. Isolate the specimen into an air-gapped forensic analysis VM or sandbox, compute its cryptographic hash (MD5, SHA-256), extract embedded strings, and inspect PE headers for anomalous imports and section entropy.
.mp4 or QuickTime .mov) place a 4-byte box size at offset 0, followed by the format signature ftyp starting at offset 4. Our matching algorithm automatically inspects both offset 0 and common sub-offsets to accurately recognize container files.