What magic bytes tell you
A file signature is a byte sequence associated with a format. It may appear at offset zero, at a documented offset, or near the end of a file. Hexadecimal notation is convenient because one byte is represented by two hex digits.
| Format | Common starting bytes | ASCII hint |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | .PNG.... |
| JPEG | FF D8 FF | Binary marker |
25 50 44 46 2D | %PDF- | |
| ZIP | 50 4B 03 04 | PK.. |
| ELF | 7F 45 4C 46 | .ELF |
| PE | 4D 5A | MZ |
A simple identification example
A challenge supplies report.txt, but the first eight bytes are:
89 50 4e 47 0d 0a 1a 0aThat sequence strongly suggests PNG. Rename a working copy to report.png, then verify that the file contains valid PNG chunks beginning with IHDR and ending with IEND. The header establishes a hypothesis; successful structural parsing strengthens it.
Understand shared container signatures
ZIP-based formats include Office documents, APK files, JAR archives, and EPUB books. Seeing 50 4B 03 04 proves only that ZIP-compatible structures may be present. List members and inspect format-specific files such as [Content_Types].xml, AndroidManifest.xml, or META-INF.
Check offsets and trailing data
Not every signature starts at byte zero, and valid content can be embedded inside another file. Search for known headers, record their offsets, and examine whether a plausible footer exists. Extra data after an end marker may be harmless padding, appended evidence, or a second embedded file.
A file can contain a valid image header and still exploit a vulnerable parser. Identification describes format evidence; it does not establish that opening the file is safe.
Common mistakes
Changing the only copy
Hash the original first and rename only a working copy. That preserves the evidence if a tool modifies metadata.
Matching a very short prefix
Two bytes such as MZ are useful but not conclusive. Check the PE header offset and broader structure before labeling the file.
Assuming one file has one format
Polyglot and concatenated files can satisfy multiple parsers. Record every relevant header, offset, footer, and extraction result.
Identification workflow
- Hash and preserve the original.
- Read at least the first 16–32 bytes in hex.
- Compare the sequence with likely signatures.
- Inspect required internal structures.
- Search for additional headers and trailing content.
- Record the conclusion and its supporting evidence.