Forensics tools
36 toolsRead files at the byte level: hex views, entropy, byte frequency, embedded file carving, string extraction, ASN.1 and ELF parsing, and steganography checks. Built for CTF work and incident response, where uploading the sample is often the one thing you must not do.
Look at the bytes10
n→nHex viewer with structure overlayA hexdump annotated with any known file signatures found in the bytes, including magic bytes and embedded formats.Runs on each file you dropn→nHexdumpClassic offset / hex / ASCII dump of any file, like `hexdump -C`.Runs on each file you dropn→nFrom hexdumpTurn a hex dump (offset / hex / ASCII text) back into the original bytes.Runs on each file you dropn→nByte frequency & chi-squareCount how often each of the 256 byte values appears in a file and compare the distribution to uniform random. A chi-square test, not a verdict.Runs on each file you dropn→nEntropy analysisMeasure the byte-level randomness of a file. High entropy suggests compression or encryption, not proof of either.Runs on each file you dropn→nSwap endiannessReverse byte order within fixed-size words: flip a file between little- and big-endian.Runs on each file you dropn→nTake bytesCut out a byte range from a file and keep only that.Runs on each file you dropn→nDrop bytesCut out a byte range from a file and keep everything else.Runs on each file you dropn→1Diff bytesByte-by-byte comparison of two files: where they diverge, by how much, and where they realign.Combines the files you dropn→1Offset checkerCompare 2+ files position by position and report which byte offsets agree across all of them.Combines the files you drop
Identify & extract10
n→nDetect file typeIdentify a file by its magic bytes, not its extension;Runs on each file you dropn→nExtract stringsPull runs of printable text out of any binary file: the classic first look at an unknown file.Runs on each file you dropn→nExtract embedded filesCarve out the bytes starting at each detected file signature, up to the next signature or end of file.Runs on each file you dropn→nScan for embedded/appended filesScan every offset for known file signatures: finds a file hidden or appended inside another, e.g. a ZIP tacked onto a JPEG. A match means "signature found here", not "a file was deliberately hidden".Runs on each file you drop1→1File tree from archiveList the paths, sizes and structure inside a ZIP or TAR archive, without extracting anything.Takes one filen→nTrailing dataFind and carve out bytes appended after a PNG/JPEG/PDF/ZIP/GIF's real end marker, a common place to smuggle a second payload.Runs on each file you dropn→nPolyglot detectCheck whether a file carries more than one valid format signature, at offset 0 or buried inside, the hallmark of a polyglot file.Runs on each file you dropn→nMagic decodeTry base64, base32, hex, URL-encoding, ROT13/47 and single-byte XOR against a string and rank the results by how much they read like real text.Runs on each file you dropn→1Folder hash manifestHash every file you drop and produce a manifest in the same `<hex> <name>` format `shasum`/`sha1sum`/`md5sum` print, for spot-checking against the real tool.Combines the files you dropn→nPDF red flagsScan a PDF's raw bytes for tokens that indicate active content, JavaScript, auto-open actions, embedded files, incremental updates, as a quick triage signal, not proof of malice.Runs on each file you drop
Parse structures7
n→nParse ASN.1Decode a DER-encoded ASN.1 structure (certificates, keys, PKCS blobs) into a readable tree.Runs on each file you dropn→nParse Object IdentifierDecode a raw ASN.1 OBJECT IDENTIFIER byte string (tag and length already stripped) into dotted-decimal form.Runs on each file you dropn→nTLV / Tag-Length-Value parserWalk a generic Tag-Length-Value byte structure with a configurable tag width and either a fixed-width or ASN.1 BER length field: protocol frames, binary records, custom containers.Runs on each file you dropn→nELF infoRead an ELF binary's header and section table: class, architecture, entry point, sections. No disassembly.Runs on each file you dropn→nPNG chunksWalk a PNG's chunk structure, type, length, offset, CRC validity, and decode IHDR and any text chunks.Runs on each file you dropn→nJPEG structureList a JPEG's marker segments and quantization tables, or produce an Error Level Analysis image to spot re-compression artifacts.Runs on each file you dropn→nZIP structureRead a ZIP central directory without extracting: entry list, compression method, ratios, offsets, and a zip-bomb heuristic.Runs on each file you drop
Images & audio5
n→nBit-plane viewerRender one bit-plane of one colour channel as a black/white image. A classic first look for hidden LSB data.Runs on each file you dropn→nLSB steganography extractPull the least-significant bit out of an image's colour channels and check whether it spells out readable text. Finding nothing proves nothing; finding text does not prove it was hidden on purpose.Runs on each file you dropn→nSplit colour channelsPull an image apart into separate red, green, blue and alpha grayscale images.Runs on each file you dropn→nExtract ID3 / audio metadataRead the descriptive tags (title, artist, album, cover art, ...) mediabunny finds in an audio or video container. ID3v2/v1, MP4 atoms, Vorbis comments and more, whichever the file has.Runs on each file you dropn→nGIF framesSplit an animated GIF into one fully-composited PNG per frame, with each frame's delay and disposal method.Runs on each file you drop
Cipher analysis1
Executables & disks3
n→nPE infoRead a Windows PE/EXE/DLL header: machine, timestamp, subsystem, entry point, sections and imported DLL names. No disassembly.Runs on each file you dropn→nMach-O infoRead a Mach-O (or fat/universal) binary's header, CPU type, load commands and segments. No disassembly.Runs on each file you dropn→nMBR / GPT partitionsRead a disk image's MBR partition table, or its GPT header and partition entries when the MBR is a GPT protective one.Runs on each file you drop
Questions
Is it safe to analyse a suspicious file here?
The file is never uploaded, which is the property these tools exist for. It is parsed in the page, so nothing executes it. Handle a live sample with the care your own procedures require; this site simply does not transmit it anywhere.
What does a high entropy value mean?
That the bytes are close to random, which fits encryption, compression and already-compressed media equally well. It is a signal to look further, not proof of anything. The tool page for entropy analysis says so.
Can I carve embedded files out of an image?
Yes. Scan embedded files reports signatures found at offsets and Extract embedded files pulls them out. Short signatures match by chance, so a hit is a lead rather than a finding.
Do these tools identify a file by content?
The file type detector reads magic bytes rather than the extension. The image tools are the exception: they pick a codec from the extension, which the pages note.
What if steganography extraction finds nothing?
It rules out one specific bit layout and nothing else. An empty result is not evidence of a clean file, and eight printable characters can appear by chance. The tool page for LSB extraction states both limits.