Forensics tools 24

Read files at the byte level: hex views, entropy, byte frequency, embedded file carving, string extraction, ASN.1 and ELF parsing, and steganography checks. Built for CTF work and incident response, where uploading the sample is often the one thing you must not do.

Look at the bytes10

n→nHex viewer with structure overlayA hexdump annotated with any known file signatures found in the bytes, including magic bytes and embedded formats.n→nHexdumpClassic offset / hex / ASCII dump of any file, like `hexdump -C`.n→nFrom hexdumpTurn a hex dump (offset / hex / ASCII text) back into the original bytes.n→nByte frequency & chi-squareCount how often each byte value appears and compare the distribution to uniform random. A chi-square test, not a verdict.n→nEntropy analysisMeasure the byte-level randomness of a file. High entropy suggests compression or encryption, not proof of either.n→nSwap endiannessReverse byte order within fixed-size words: flip a file between little- and big-endian.n→nTake bytesCut out a byte range from a file and keep only that.n→nDrop bytesCut out a byte range from a file and keep everything else.n→1Diff bytesByte-by-byte comparison of two files: where they diverge, by how much, and where they realign.n→1Offset checkerCompare 2+ files position by position and report which byte offsets agree across all of them.

Identify & extract5

n→nDetect file typeIdentify a file by its magic bytes, not its extension;n→nExtract stringsPull runs of printable text out of any binary file: the classic first look at an unknown file.n→nExtract embedded filesCarve out the bytes starting at each detected file signature, up to the next signature or end of file.n→nScan for embedded/appended filesScan every offset for known file signatures: finds a file hidden or appended inside another, e.g. a ZIP tacked onto a JPEG. A match means "signature found here", not "a file was deliberately hidden".1→1File tree from archiveList the paths, sizes and structure inside a ZIP or TAR archive, without extracting anything.

Parse structures4

n→nParse ASN.1Decode a DER-encoded ASN.1 structure (certificates, keys, PKCS blobs) into a readable tree.n→nParse Object IdentifierDecode a raw ASN.1 OBJECT IDENTIFIER byte string (tag and length already stripped) into dotted-decimal form.n→nParse TLVWalk a generic Tag-Length-Value byte structure with a configurable tag and length width: protocol frames, binary records, custom containers.n→nELF infoRead an ELF binary's header and section table: class, architecture, entry point, sections. No disassembly.

Images & audio4

n→nBit-plane viewerRender one bit-plane of one colour channel as a black/white image. A classic first look for hidden LSB data.n→nLSB steganography extractPull the least-significant bit out of an image's colour channels and check whether it spells out readable text. Finding nothing proves nothing; finding text does not prove it was hidden on purpose.n→nSplit colour channelsPull an image apart into separate red, green, blue and alpha grayscale images.n→nExtract ID3 / audio metadataRead the descriptive tags (title, artist, album, cover art, ...) mediabunny finds in an audio or video container. ID3v2/v1, MP4 atoms, Vorbis comments and more, whichever the file has.

Cipher analysis1

n→nIndex of coincidenceClassic cryptanalysis statistic on the letters in a file. Helps tell natural-language text from a well-mixed cipher or random data.

Questions

Is it safe to analyse a suspicious file here?

The file is never uploaded, which is the property these tools exist for. It is parsed in the page, so nothing executes it. Handle a live sample with the care your own procedures require; this site simply does not transmit it anywhere.

What does a high entropy value mean?

That the bytes are close to random, which fits encryption, compression and already-compressed media equally well. It is a signal to look further, not proof of anything. The tool page for entropy analysis says so.

Can I carve embedded files out of an image?

Yes. Scan embedded files reports signatures found at offsets and Extract embedded files pulls them out. Short signatures match by chance, so a hit is a lead rather than a finding.

Do these tools identify a file by content?

The file type detector reads magic bytes rather than the extension. The image tools are the exception: they pick a codec from the extension, which the pages note.

What if steganography extraction finds nothing?

It rules out one specific bit layout and nothing else. An empty result is not evidence of a clean file, and eight printable characters can appear by chance. The tool page for LSB extraction states both limits.