Scan for embedded/appended files
Scan every offset for known file signatures: finds a file hidden or appended inside another, e.g. a ZIP tacked onto a JPEG. A match means "signature found here", not "a file was deliberately hidden".
Runs on your device. The file is never uploaded.
Scan for embedded/appended files lists every offset where one of the 34 known signatures matches, with the format name and extension. Matches at offset 0 are labelled as the start of file, and the closing line counts the rest. A signature at a non-zero offset means those bytes are present, not that anything was hidden deliberately.
Questions
What does a match at a non-zero offset mean?
That a known signature pattern appears at that byte position. It does not mean a file was deliberately hidden there. The report says so directly, flagging non-zero matches as worth a closer look while stating that this alone proves nothing about intent. Compressed and encrypted regions throw off short patterns by chance, and many formats legitimately embed thumbnails, icons and archives.
How do I read the output?
The header gives the file size and the number of matches. Then one line per match, sorted by offset: the offset as 8 hex digits, the format name and its extension, with a note on any match at offset 0 that it is the start of file. The closing line either counts the non-zero matches or tells you every match was at offset 0 and nothing else was detected.
Will it find a ZIP appended to a JPEG?
Yes, if the appended data starts with one of the signatures in the table. That is the case this is built for: the JPEG matches at offset 0 and the ZIP shows up at its own offset further in. Carve it with Extract embedded files, or cut the exact range with Take bytes if you know where it ends.
What does "no known file signatures found anywhere in the file" mean?
That none of the roughly 34 patterns in the table matched at any offset, not even at the start. The file is still something. Plain text, CSV, JSON and many formats have no magic bytes, and a signature table this size covers common formats rather than everything. Absence of a match is not evidence of an empty or clean file.
Does the scan look at the whole file?
Yes. Every offset is tested against every signature, so nothing is sampled or skipped, and every match is listed with no cap. The trade-off is speed: the scan is brute force over the file times the table, and a large file will take a while in the worker.
Does my file leave the device?
No. The scan runs against a signature table bundled with the page, in a Web Worker in this tab. Nothing is uploaded and no hash is submitted to any lookup service, so scanning a piece of evidence here does not tell anyone that you have it.