Skip to content

PE (Portable Executable) header

The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an optional header (despite the name, mandatory in practice), and section headers (.text, .data, .rdata, .rsrc). Imports/exports tables and the resource directory are the analyst's primary entry points.

Explained in

Related terms

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.