File forensics and carving
Identify files by their bytes, find data appended past a format’s end marker, and pull evidence out of images and documents.
By the end you can
- Identify a file’s real type regardless of extension
- Find and extract data hidden after a format’s terminator
- Read EXIF, PNG chunks, and JPEG segments for metadata and appended payloads
- Repair a deliberately corrupted header
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Hex viewer and hexdump
Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.
PNG chunk analyzer
Walk a PNG chunk by chunk, validate CRCs, read tEXt and zTXt metadata, and find data hidden after IEND or in non-standard chunks.
EXIF metadata viewer
Read EXIF, GPS coordinates, camera details, timestamps, and embedded comments from images - the metadata that answers OSINT challenges.
Magic byte and file signature table
Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 34 match in total - see the full index.
Checkpoint
Given a polyglot file, extract every embedded file it contains and state the offset and signature of each.
Teaching note
Students reach for the steganography solver too early here. Make them run strings and check the magic bytes first, every time - most 'stego' challenges at this level are a ZIP glued onto a PNG.