Share:
Glossary Forensics

Magic bytes

Magic bytes, or a file signature, are the fixed bytes at the start of a file that identify its true format regardless of its name or extension.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

A PNG starts 89 50 4E 47, a PDF starts %PDF, a ZIP starts PK. Checking them detects files whose extension lies and underlies upload validation and data carving. See How File Signatures (Magic Bytes) Work.

Try these tools

Binary & Archive Forensics

Inspect any file's true type by magic bytes, carve embedded files at any offset.

MIME Type Lookup

Look up a MIME type from a file extension, or find the file extension(s) for a MIME type.

See also

  • Glossary File carving
    File carving is recovering files from raw storage by searching for their start and end signatures.
  • Glossary MIME type
    A MIME type (media type) names the format of content as type/subtype, such as text/html or image/png, so software knows how to handle it.
  • Glossary Hexadecimal
    Hexadecimal (hex) is the base-16 number system, using digits 0-9 and letters A-F, widely used as a compact way to write binary data.
  • Guide How File Signatures (Magic Bytes) Work
    How the first bytes of a file identify its real type, a table of common signatures verified against real files.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard