Common File Signature Reference
File signatures can help identify likely formats and carving candidates. A matching header does not establish authenticity, completeness, origin, or safe content.
PUBLIC OPERATIONAL REFERENCE
Selected signatures
| Format | Common header bytes | Important limit |
|---|---|---|
| JPEG | FF D8 FF | Multiple JPEG variants share the prefix; validate structure and end markers. |
| PNG | 89 50 4E 47 0D 0A 1A 0A | Validate chunks, ordering, CRCs, and any appended data. |
| GIF | 47 49 46 38 37 61 or 47 49 46 38 39 61 | The version marker alone does not prove the file is complete. |
| 25 50 44 46 2D | PDFs can contain incremental revisions, embedded files, scripts, and damaged cross-reference data. | |
| ZIP / OOXML | 50 4B 03 04 | ZIP-based formats require internal-path and content validation. |
| SQLite | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | Collect associated WAL and journal files when they may contain relevant records. |
| Windows PE | 4D 5A | MZ is only an initial marker; validate PE headers and structure. |
| ELF | 7F 45 4C 46 | Class, byte order, architecture, and program headers require separate parsing. |
Carving and validation
- Confirm the offset, allocation context, and surrounding data.
- Validate internal structure rather than relying on a two- or four-byte match.
- Record whether the recovered content is complete, fragmented, truncated, overwritten, or reconstructed.
- Hash the recovered output and preserve the source location and carving method.
- Treat active content and unknown files as potentially unsafe.
Continue with the complete workflow
Public references are starting points. DFIR Field Toolkit connects operational references with an encrypted local case record, evidence inventory, field forms, amendments, and exports.
Create one complete case free or explore the synthetic product demo.