Trailing data

Find and carve out bytes appended after a PNG/JPEG/PDF/ZIP/GIF's real end marker, a common place to smuggle a second payload.

Trailing data walks a PNG, JPEG, PDF, ZIP or GIF's own structure to find its real end marker. That marker is IEND, EOI, the last %%EOF, the central-directory record, or the GIF trailer byte. It reports whatever bytes follow that marker. Anything found gets carved into its own file rather than only counted. An unrecognised signature is refused.

Questions

What formats does it walk?

PNG, JPEG, PDF, ZIP and GIF, each walked with real container-parsing logic, not a byte-string search for the end marker.

Why not search for the marker text?

Because a marker like %%EOF or byte 0x3B can legitimately appear inside a format's own compressed payload before the real end, so a text search would find the wrong one.

What happens when trailing data is found?

It is carved out into its own separate file, in addition to reporting the byte count and offset.

What if the format is not recognised?

The tool refuses, naming that the file matches none of the five supported signatures at offset 0.

What if the end marker cannot be located?

The tool refuses, reporting the file as recognised but malformed or truncated.

Related Forensics tools

n→nDetect file typeIdentify a file by its magic bytes, not its extension;n→nExtract stringsPull runs of printable text out of any binary file: the classic first look at an unknown file.n→nExtract embedded filesCarve out the bytes starting at each detected file signature, up to the next signature or end of file.n→nScan for embedded/appended filesScan every offset for known file signatures: finds a file hidden or appended inside another, e.g. a ZIP tacked onto a JPEG. A match means "signature found here", not "a file was deliberately hidden".1→1File tree from archiveList the paths, sizes and structure inside a ZIP or TAR archive, without extracting anything.n→nPolyglot detectCheck whether a file carries more than one valid format signature, at offset 0 or buried inside, the hallmark of a polyglot file.n→nMagic decodeTry base64, base32, hex, URL-encoding, ROT13/47 and single-byte XOR against a string and rank the results by how much they read like real text.n→1Folder hash manifestHash every file you drop and produce a manifest in the same `<hex> <name>` format `shasum`/`sha1sum`/`md5sum` print, for spot-checking against the real tool.