Magic Byte & File Header Hex Integrity Inspector
When a file refuses to open or triggers a corruption error, file extensions often lie. This client-side forensics engine disassembles the first 512 bytes in hexadecimal and ASCII, matches against 50+ ISO/RFC magic byte signatures, audits for malware extension spoofing (e.g. .pdf.exe), evaluates Shannon byte entropy, and validates trailer markers (%%EOF, IEND, EOCD) to determine whether data is recoverable.
Drop any suspicious or damaged file here to inspect magic bytes
Reads the first 512 bytes locally in your browser memory. Zero files are uploaded to any server. 100% private.
Standard Magic Byte Header Directory
Common binary file headers recognized by the in-browser forensics engine:
DOS MZ header required by all Windows executables and dynamic libraries.
Standard binary format for Linux/Unix executables and shared libraries.
Mach-O 64-bit binary format for macOS and iOS executable code.
Compiled Java virtual machine bytecode file.
Standard PDF header (%PDF-).
ZIP container standard used by Word, Excel, and PowerPoint since 2007.
Microsoft Compound File Binary Format (OLE2 / Structured Storage).
Standard Microsoft Rich Text Format header (\rtf).
Standard 8-byte PNG file magic header.
1. What Are Magic Bytes? Why File Extensions Lie
In modern computing, the three- or four-letter filename extension (such as .docx, .png, or .pdf) is merely a user-friendly hint provided to the operating system shell to assign a default application icon. However, the operating system kernel and file-parsing libraries determine the actual encoding using magic numbers—constant byte sequences placed at precise offsets defined by international specifications (ISO, IETF RFCs, and IEEE standards).
If a document is renamed from quarterly_report.zip to quarterly_report.docx, Microsoft Word will inspect the first four bytes (50 4B 03 04). If the inner directory structure does not contain the mandatory [Content_Types].xml schema, Word abruptly rejects the file with the dreaded message: “Word found unreadable content. Do you want to recover?”Inspecting the raw magic bytes reveals the true container architecture instantly.
2. Malware Extension Spoofing: How Executables Hide as Documents
Cybersecurity threat actors frequently exploit user trust by masking malicious binaries behind everyday business extensions. The most dangerous form of corruption is deliberate extension spoofing:
- Windows PE Executables (MZ Header): If a file named
receipt.pdfstarts with hex bytes4D 5A(ASCII “MZ”), it is not an Adobe document—it is a compiled Windows Portable Executable. Opening it executes machine code directly on your CPU. - Linux ELF Binaries: Files starting with
7F 45 4C 46(“.ELF”) are compiled Unix binaries capable of running background shell scripts or reverse shells. - Double Extensions & Unicode RLO: Windows hides known extensions by default, turning
invoice.pdf.exeinto what appears to beinvoice.pdfin File Explorer. Our byte-level inspector bypasses Explorer abstractions and inspects the raw ArrayBuffer.
3. Diagnosing File Corruption: Null Byte Padding vs Truncated EOF Trailers
When files become corrupt, the failure almost always concentrates at the head or the tail:
| Corruption Pattern | Hex Signature Behavior | Underlying Cause | Recovery Feasibility |
|---|---|---|---|
| 00 00 00 00 ... | Leading 64+ bytes all zero | Interrupted write buffer / disk disconnect | Zero Recovery (Data lost) |
| Missing %%EOF | Header intact (%PDF), tail truncated | Aborted web download or email attachment cut | High (Re-download file) |
| PK 03 04 Mismatch | ZIP header present, missing EOCD record | Multi-part zip missing or partial transfer | Moderate (Archive repair) |
| Encoding BOM Shift | EF BB BF / FF FE prepended | Text editor saved binary with UTF BOM | 100% (Strip BOM bytes) |
4. Shannon Byte Entropy: Detecting Encrypted vs Plain-Text Streams
Claude Shannon’s information entropy formula quantifies the degree of unpredictability in a data set. In file forensics, entropy serves as a vital diagnostic metric:
- Entropy < 4.0 bits/byte: Uncompressed plain text, log files, or zero-padded data. If a JPEG or PNG has an entropy of 3.2, its internal image data is severely damaged or empty.
- Entropy 4.0 – 7.2 bits/byte: Structured binary documents, uncompressed audio (WAV), and bitmap graphics containing predictable header tables and color palettes.
- Entropy > 7.6 bits/byte: Maximum entropy approaching true random noise. This indicates modern high-efficiency compression (7z, WebP, AVIF) or cryptographic encryption.
Frequently Asked Questions
What are magic bytes and why do operating systems rely on them?
Magic bytes (also known as file signatures) are specific sequences of hex bytes placed at the very beginning (offset 0) of a binary file. While file extensions (like .pdf or .png) can be easily changed or stripped by users, software and operating systems inspect magic bytes to verify the true underlying file format. For example, all PNG images begin with the 8-byte sequence "89 50 4E 47 0D 0A 1A 0A", and all PDFs begin with "25 50 44 46" (%PDF-).
How do malicious files use extension spoofing?
Attackers frequently disguise dangerous executable payloads by naming them with innocent extensions (e.g., "invoice.pdf.exe", or using the Right-to-Left Override Unicode character to reverse the filename). If an employee receives a file named "quarterly_budget.xlsx" but its header reveals "4D 5A" (the DOS MZ signature of a Windows PE executable), the operating system could execute arbitrary code if launched. Inspecting magic bytes exposes the true binary payload before you click.
What does it mean if the hex dump is filled with "00 00 00 00"?
A file filled with consecutive 0x00 null bytes indicates a severe write failure or physical storage disconnect. This commonly happens when a USB drive is unplugged before the operating system write-cache flushes, when a cloud synchronization tool allocates disk space but drops the transfer, or following an unexpected system crash. Null-padded files contain no recoverable data in those sectors.
What is Shannon Entropy and how does it diagnose file corruption?
Shannon Entropy measures the randomness of bytes in a buffer on a scale from 0.0 to 8.0 bits per byte. Plain uncompressed text files (like TXT, CSV, or HTML) have low entropy (typically 2.5 to 4.5) because English characters repeat frequently. Compressed or encrypted files (like 7z, GZ, PNG, or AES containers) display very high entropy (7.5 to 8.0). If an archive or image file exhibits low entropy, it is almost certainly corrupted or unpopulated.
Why are trailer markers (like %%EOF or IEND) critical for file recovery?
Many container formats (including PDF, PNG, and ZIP) require both a valid header and a terminal trailer marker. In PDFs, the "%%EOF" marker tells the document reader where the cross-reference (XREF) table resides. In ZIP and Office OpenXML files (DOCX/XLSX), the End of Central Directory (EOCD: "50 4B 05 06") lists all file entries. If these tail markers are missing, the file was truncated during download.
Does this tool upload my sensitive files to a remote server?
No. The FileFixPro Magic Byte Inspector uses the standard HTML5 FileReader API to slice the first 512 bytes and trailing 128 bytes directly in your web browser memory. Zero bytes are ever transmitted over the network or stored on any server. You can inspect confidential contracts, medical records, and proprietary binaries with absolute privacy.
Official Standards & Binary Format Specifications
- ISO 32000-1 / PDF 1.7: Adobe Portable Document Format Reference Architecture.
- W3C PNG Specification (Third Edition): Portable Network Graphics Magic Numbers & Chunks.
- PKWARE APPNOTE.TXT: .ZIP File Format Specification & End of Central Directory (EOCD).
- Microsoft Corporation: PE and COFF Specification for Windows Binary Architectures.
- RFC 2046: Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types.