File signatures

Overview

Every file claims to be something through its extension — .png, .zip, .pdf — but the extension is just a label a user can rename freely. What a file actually is depends on its bytes. Most formats begin with a fixed sequence of bytes called a file signature or magic number that identifies the format regardless of the name. In CTF forensics and in real incident response, reading these bytes is the first, most reliable step in figuring out what a file truly is.

Learning objectives

• Define a file signature (magic number) and explain why it is more trustworthy than the extension.
• Recognize the accurate magic bytes of several common formats.
• Use a hex viewer and the file command to identify a file by its header.
• Explain how signature analysis reveals disguised or corrupted files.

Core concept

A file signature is a short, well-known byte sequence at (or near) the start of a file that marks its format. Because most parsers read this header to decide how to interpret the rest of the file, the signature is the format's real identity. An attacker or a challenge author can rename secret.zip to photo.png, but the bytes at the front still say ZIP. Learning to read the header lets you cut through that mislabeling.

Signatures are usually written in hexadecimal — two hex digits per byte. Many are also readable as ASCII text, which is why you will often see the same value shown both ways.

How it works

When you open a file in a hex editor or run a tool like file, you compare the leading bytes against a database of known signatures. Here are accurate signatures for common formats (offset 0 unless noted):

• PNG image: 89 50 4E 47 0D 0A 1A 0A — the bytes 50 4E 47 spell PNG.
• JPEG image: FF D8 FF — every JPEG starts this way.
• GIF image: 47 49 46 38 — ASCII GIF8 (followed by 7a or 9a for GIF87a/GIF89a).
• PDF document: 25 50 44 46 — ASCII %PDF.
• ZIP archive (also .docx, .jar, .apk): 50 4B 03 04 — ASCII PK followed by 03 04.
• GZIP compressed: 1F 8B.
• ELF Linux executable: 7F 45 4C 46 — 7F then ASCII ELF.
• PDF/Office note: modern Office files (.docx, .xlsx, .pptx) are actually ZIP archives, so they carry the 50 4B 03 04 signature.

Some formats also have a trailer (bytes at the end). For example, a PNG ends with an IEND chunk. Comparing the header, the trailer, and the extension together is how you spot a file that has been altered or has extra data appended.

Practical example

In an authorized forensics challenge you are given image.png, but image viewers refuse to open it. You inspect the first bytes with a hex viewer:

$ xxd image.png | head -n 1
00000000: 504b 0304 1400 0000 0800 ...   PK..........

The header is 50 4B 03 04 (PK), not the PNG magic 89 50 4E 47. Despite the .png name, this is a ZIP archive. Renaming it to image.zip and extracting it in your sandbox reveals the hidden files. The file command confirms the same conclusion by reading the signature rather than the extension:

$ file image.png
image.png: Zip archive data, at least v2.0 to extract

Cybersecurity relevance

Signature analysis is foundational to digital forensics and malware triage. Investigators use it to detect files masquerading under a false extension — a common trick for smuggling executables or archives past naive filters. It also underpins content-type validation: an upload filter that trusts the .jpg extension or the client-supplied MIME type is weak, because those are attacker-controlled. Checking the real magic bytes server-side is a much stronger control. The same skill helps you recognize corrupted files (a broken header) and files with data appended after the legitimate trailer.

Common mistakes

• Trusting the extension or MIME type instead of the actual bytes; both are easily forged.
• Confusing hex and ASCII views — 50 4B and PK are the same two bytes shown differently.
• Checking only the header and missing appended data past the file's normal trailer.
• Assuming a signature guarantees validity — the header can be correct while the rest of the file is malformed or malicious.

Key takeaways

• A file signature (magic number) is a fixed byte sequence at the start of a file that identifies its true format.
• Accurate examples: PNG 89 50 4E 47, JPEG FF D8 FF, GIF 47 49 46 38 (GIF8), PDF 25 50 44 46 (%PDF), ZIP 50 4B 03 04 (PK), GZIP 1F 8B, ELF 7F 45 4C 46.
• The extension and MIME type are labels; the bytes are the truth. Use a hex viewer or file to read them.
• Signature checks reveal disguised, corrupted, or tampered files and are the basis of strong server-side content validation.

Check your understanding

• A file named report.pdf begins with the bytes 50 4B 03 04. What format is it really, and how do you know?
• Why is validating an upload by its magic bytes stronger than trusting the file extension or the client-supplied MIME type?