File Signature (Magic Bytes)
Definition
The fixed byte sequence at the start of a file that identifies its format. JPEG files begin with FF D8 FF; PNG files begin with 89 50 4E 47 0D 0A 1A 0A. A file whose extension does not match its magic bytes has been mislabelled, which itself requires explanation.
- JPEG signature
- FF D8 FF
- PNG signature
- 89 50 4E 47 0D 0A 1A 0A
- Location
- Fixed byte sequence at the start of a file
- Forensic use
- Mismatch with the extension flags mislabelling
Common questions
Why does a mismatch between file extension and magic bytes matter forensically?+
An extension is just a naming convention a user or program can change freely, but the magic bytes reflect what the file actually is, so a mismatch shows the file was renamed, which itself becomes something to explain, such as an attempt to disguise content.
Can magic bytes be forged or stripped to defeat file identification?+
Yes, header bytes can be altered or removed, so a thorough examination cross-checks the signature against the rest of the file structure and content rather than relying on the first bytes alone.
Related terms
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- JPEG Quantisation Table
- A matrix of 64 values embedded in a JPEG file that controls the precision with which each frequency component of the image...
- PNG Chunk
- The basic structural unit of a PNG file. Each chunk has a four-character type code, a length field, a data payload, and...
- Thumbnail Inconsistency
- Many cameras embed a reduced-resolution preview image inside the EXIF header of a JPEG. If the main image has been cropped or...
- XMP (Extensible Metadata Platform)
- An Adobe-defined metadata format stored as an XML packet embedded in image files. XMP carries a software history field (xmpMM:History) that editing...