hexforge / guides / file-signatures

GUIDE 05 / FORENSICS

File Signatures and Hex

A filename can lie. The first bytes often provide a better hypothesis, but reliable identification also checks the file's internal structure and boundaries.

What magic bytes tell you

A file signature is a byte sequence associated with a format. It may appear at offset zero, at a documented offset, or near the end of a file. Hexadecimal notation is convenient because one byte is represented by two hex digits.

FormatCommon starting bytesASCII hint
PNG89 50 4E 47 0D 0A 1A 0A.PNG....
JPEGFF D8 FFBinary marker
PDF25 50 44 46 2D%PDF-
ZIP50 4B 03 04PK..
ELF7F 45 4C 46.ELF
PE4D 5AMZ

A simple identification example

A challenge supplies report.txt, but the first eight bytes are:

89 50 4e 47 0d 0a 1a 0a

That sequence strongly suggests PNG. Rename a working copy to report.png, then verify that the file contains valid PNG chunks beginning with IHDR and ending with IEND. The header establishes a hypothesis; successful structural parsing strengthens it.

Understand shared container signatures

ZIP-based formats include Office documents, APK files, JAR archives, and EPUB books. Seeing 50 4B 03 04 proves only that ZIP-compatible structures may be present. List members and inspect format-specific files such as [Content_Types].xml, AndroidManifest.xml, or META-INF.

Check offsets and trailing data

Not every signature starts at byte zero, and valid content can be embedded inside another file. Search for known headers, record their offsets, and examine whether a plausible footer exists. Extra data after an end marker may be harmless padding, appended evidence, or a second embedded file.

A signature is not a safety verdict

A file can contain a valid image header and still exploit a vulnerable parser. Identification describes format evidence; it does not establish that opening the file is safe.

Common mistakes

Changing the only copy

Hash the original first and rename only a working copy. That preserves the evidence if a tool modifies metadata.

Matching a very short prefix

Two bytes such as MZ are useful but not conclusive. Check the PE header offset and broader structure before labeling the file.

Assuming one file has one format

Polyglot and concatenated files can satisfy multiple parsers. Record every relevant header, offset, footer, and extraction result.

Identification workflow

  1. Hash and preserve the original.
  2. Read at least the first 16–32 bytes in hex.
  3. Compare the sequence with likely signatures.
  4. Inspect required internal structures.
  5. Search for additional headers and trailing content.
  6. Record the conclusion and its supporting evidence.