ForensicsRuns locallyNo account

PNG chunk analyzer

Walk a PNG chunk by chunk, validate CRCs, read tEXt and zTXt metadata, and find data hidden after IEND or in non-standard chunks.

Open in ctfpal

A PNG is a sequence of length-prefixed chunks, each with a four-letter type and a CRC32. That rigid structure makes tampering detectable and makes hiding places obvious once you know where to look.

Walking the chunk list is therefore a complete audit of the file rather than a search: every byte of a PNG belongs to some chunk, so anything that does not fit the chunk structure is, by definition, not supposed to be there. That is a much stronger position than hunting through a format with optional or variable-length regions.

The four places data hides

After IEND. IEND is the terminator; every viewer stops there. Bytes after it are free space, and they are usually another whole file.
In tEXt, zTXt, and iTXt chunks. Legitimate metadata chunks that hold arbitrary text, compressed in the zTXt case.
In unknown chunk types. Decoders ignore chunks they do not recognise if the type’s first letter is lowercase (the 'ancillary' bit). An author can invent stEg and every viewer will skip it silently.
In the pixel data itself. That is LSB steganography, a different technique with a different tool.