Source: Juni_2026_Exams/Advance_Forensics/notes/09-file-format-and-magic-bytes.md

📄 File Format & Magic Bytes

What are Magic Bytes?

Magic bytes = First few bytes of a file that identify its type.

Forensic use: Detect if file extension is fake or if file is corrupted.

🎯 Common File Formats

Document Files

PDF:
Magic Bytes: 25 50 44 46 (hex) or %PDF (ASCII)
Extension: .pdf
Normal location: Documents, Desktop

Word:
Magic Bytes: D0 CF 11 E0 (hex) - OLE format
Extension: .doc, .docx

Executable Files

Windows EXE/DLL:
Magic Bytes: 4D 5A (hex) or MZ (ASCII)
Extension: .exe, .dll, .sys
Normal location: Program Files, System32
Suspicious location: Temp, AppData/Local/Temp

PE Header: Follows MZ, contains executable metadata

Archive Files

ZIP:
Magic Bytes: 50 4B (hex) or PK (ASCII)
Extension: .zip
Variations: .docx, .xlsx, .jar (all ZIP-based)

RAR:
Magic Bytes: 52 61 72 21 (hex) or Rar! (ASCII)
Extension: .rar

Image Files

PNG:
Magic Bytes: 89 50 4E 47 (hex)
Extension: .png

JPEG:
Magic Bytes: FF D8 FF (hex)
Extension: .jpg, .jpeg

🔍 File Format Mismatch Detection

Scenario: File Extension is Fake

Example: malware.txt
Actual magic bytes: 4D 5A (MZ) = Executable!

Meaning: File is actually an executable disguised as text
Forensic implication: User might have double-clicked it

How to Check

Method 1: Hex viewer
- Open file in hex editor
- Read first 4-8 bytes
- Compare to known signatures

Method 2: File command (Linux)
file malware.txt
Result: "PE executable (x86)"

Method 3: Online services
- Upload file to VirusTotal
- Shows detected file type

🚨 Forensic Indicators

Red Flag 1: Executable in Temp Folder

Location: C:\Users\[user]\AppData\Local\Temp\
File: something.exe

Magic bytes: MZ (confirmed executable)

Meaning: Downloaded and executed malware

Red Flag 2: Hidden Extension

Filename: document.pdf.exe

Windows shows: document.pdf (hides .exe)
User thinks: PDF file

Reality: Executable file!

Red Flag 3: Mismatch Between Name and Content

Filename: picture.jpg
Magic bytes: PK (ZIP format)

Meaning: Could be compressed malware disguised as image

📋 For Your Exam

What You Need to Know

• [ ] MZ = Windows executable
• [ ] %PDF = PDF document
• [ ] PK = ZIP archive (including .docx, .xlsx)
• [ ] Temp folder + executable = suspicious

What You Don't Need to Know

• ❌ Hexadecimal of every file type
• ❌ Reverse engineering file formats
• ❌ PE header structure details

💡 Quick Reference

Suspicious combination = Extension hides true type
Suspicious location = Temp, Downloads, AppData\Local\Temp
Suspicious magic bytes = MZ in Temp folder

Last Updated: June 15, 2026