Hex Encoding and File Format Analysis

What it is

Every file is bytes. A hex editor shows those bytes with their position, so an investigator can identify a file by its header, spot data hidden inside it and read embedded metadata. File signatures matter because extensions can be changed while the content bytes are a stronger indicator of the real type.

The exam asks for signatures, encoding facts, offsets and what metadata a format holds.

How it works

Character encoding

Windows uses UTF-16 in many places, so strings in memory and files often look like text with a zero byte between every letter.

Offset

An offset is the distance in bytes from the start of a file, a sector or a disk. A hex editor shows the offset down the left side. The first byte is offset 0. A signature "at offset 0" means the very first bytes.

Hex editors and hexadecimal notation

Hexadecimal is base 16 (digits 0 to 9 and A to F). One byte is two hex digits, such as 0xFF (255). Multi byte numbers on x86 are stored little endian: 0x12345678 appears as 78 56 34 12.

Editors include HxD, WinHex, 010 Editor, Hex Workshop and Hex Fiend. On Linux:

xxd -l 64 photo.jpg
hexdump -C -n 64 photo.jpg

Both print the first 64 bytes with offsets and ASCII.

Common file signatures

JPEG and BMP analysis

A JPEG is a series of markers: SOI (FF D8), application segments (APP0 FF E0, APP1 FF E1 for EXIF), quantization and Huffman tables, the frame header, the scan data and EOI (FF D9). Data after the EOI marker deserves a closer look, because it may be appended hidden content (some cameras also append legitimate data).

A BMP starts with a 14 byte file header (BM, file size, offset to pixel data), then a DIB header giving width, height and bits per pixel. BMP files are large and uncompressed, which makes them common carriers for hidden data.

EXIF data

EXIF is metadata in the APP1 segment of JPEG and in TIFF. It can hold camera make and model, DateTimeOriginal, software used, orientation, an embedded thumbnail and GPS latitude and longitude.

exiftool -Make -Model -DateTimeOriginal -GPSLatitude -GPSLongitude photo.jpg

A mismatch between the thumbnail and the main image, or a Software tag naming an editor, suggests editing. Many social platforms strip EXIF on upload, so its absence is not proof of tampering.

Hex view of other image formats

PNG is made of chunks (IHDR, IDAT, IEND), each with a length, a type and a CRC. GIF has a header, a logical screen descriptor and blocks. TIFF starts with 49 49 2A 00 (little endian) or 4D 4D 00 2A (big endian).

PDF, Word, PowerPoint and Excel

Renaming a DOCX to ZIP lets an analyst open the parts directly.

Hex view of other formats

Executables begin with MZ and have a PE header. Archives start with PK, Rar!, or 37 7A BC AF 27 1C for 7-Zip. Audio and video files have their own headers, and an MP3 may begin with ID3.

A worked example

A file named report.txt is flagged. In a hex editor, offset 0 shows 25 50 44 46, and the end contains %%EOF.

The bytes indicate it is a PDF with the wrong extension. The analyst records the mismatch, hashes the file and reads its metadata with a parser.

How the exam asks about this

• "Which hex bytes start a JPEG file?" → FF D8 FF.
• "What does the signature 4D 5A indicate?" → A Windows executable (MZ header).
• "Which tag in a photo can reveal where it was taken?" → The EXIF GPS latitude and longitude.