Skip to content

File signature (magic bytes)

Definition

The fixed byte sequence at the start of a file that identifies its format. JPEG files begin with FF D8 FF; PNG files begin with 89 50 4E 47 0D 0A 1A 0A. A file whose extension does not match its magic bytes has been mislabelled, which itself requires explanation.

Related terms

EXIF (Exchangeable Image File Format)
A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
JPEG quantisation table
A matrix of 64 values embedded in a JPEG file that controls the precision with which each frequency component of the image...
PNG chunk
The basic structural unit of a PNG file. Each chunk has a four-character type code, a length field, a data payload, and...
Thumbnail inconsistency
Many cameras embed a reduced-resolution preview image inside the EXIF header of a JPEG. If the main image has been cropped or...
XMP (Extensible Metadata Platform)
An Adobe-defined metadata format stored as an XML packet embedded in image files. XMP carries a software history field (xmpMM:History) that editing...

Explained in

  • Image File Format and Integrity ChecksThe fixed byte sequence at the start of a file that identifies its format. JPEG files begin with FF D8 FF; PNG files begin with 89 50 4E 47 0D 0A 1A 0A. A file...

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.