File Analysis Fundamentals

Identify mystery files, find hidden data in metadata, and extract embedded archives from any forensics challenge.

The first three commands

Run these on every forensics challenge file before anything else:

file suspicious.jpg           # what is it really?
strings suspicious.jpg        # printable text — flag may be here
xxd suspicious.jpg | head -20  # magic bytes + first bytes of data

File carving with binwalk

Many challenges hide a file inside another file (a ZIP inside a JPEG, a PNG inside a PDF). binwalk finds embedded file signatures:

binwalk suspicious.jpg        # list signatures found
binwalk -e suspicious.jpg     # extract everything found

After extraction, check _suspicious.jpg.extracted/ for the hidden files.

Metadata with ExifTool

Images, PDFs, and Office documents carry metadata that often holds a flag or a clue:

exiftool suspicious.jpg
# Look for: Comment, Description, Artist, GPS, CreateDate

ZIP files with passwords

Challenge archives are often password-protected. First check if the password is hinted in the challenge text. If not:

# Try common passwords
unzip -P "password123" protected.zip

# Use a wordlist
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt protected.zip

Hex patterns to recognise

Magic bytes	Format
`FF D8 FF`	JPEG
`89 50 4E 47`	PNG
`25 50 44 46`	PDF
`50 4B 03 04`	ZIP / DOCX / XLSX / JAR
`7F 45 4C 46`	ELF binary
`1F 8B`	gzip

Any file can contain any other file after its own data ends — forensics challenges exploit this routinely.