Home/File DNA Analyzer

🕵️ File DNA Analyzer

Upload any file for deep forensic analysis — magic byte detection, hex dump, extracted strings, Shannon entropy visualization. Identify encrypted files, detect mismatched extensions, and compare two files.

🕵️
Drop any file here for forensic analysis
Any file type — EXE, PDF, ZIP, images, documents

How File Forensics Works

Magic Bytes — Every file format has a unique signature in its first few bytes. A JPEG always starts with FF D8 FF. A PNG starts with 89 50 4E 47. We check 24 signatures to identify the true file type, regardless of extension.

Shannon Entropy — Entropy measures randomness. Encrypted or compressed data has very high entropy (near 8.0 bits/byte). Plain text has low entropy. A ZIP file disguised as a document will betray itself with unusually high entropy in its header region.

Analyze Any File's True Type, Hex Structure, Embedded Strings, and Magic Bytes

File DNA Analyzer identifies the true nature of any file regardless of its extension. Malware commonly masquerades as innocent files by changing extensions — a .jpg that is actually an executable, a .pdf that contains a hidden zip archive, a .txt that is actually an XML file. This tool reads the file's magic bytes (the first few bytes that identify the true format) and compares them against a database of hundreds of file signatures.

The hex viewer renders the complete file content as hexadecimal bytes alongside the ASCII representation. This is the fundamental view used in reverse engineering and forensic analysis — the same view you would see in professional tools like HxD, 010 Editor, or xxd. Interesting byte sequences are automatically annotated: file headers, structure delimiters, embedded file signatures, and human-readable strings.

String extraction pulls all sequences of 4+ consecutive printable ASCII characters from anywhere in the file, including inside compressed or encrypted sections where possible. This routinely reveals hardcoded credentials, API keys, server addresses, error messages, and debugging information that developers inadvertently left in production binaries.

⚡ How to Use

  1. 1Drop any file into the upload zone — any type, any size up to the browser limit.
  2. 2Magic byte identification is immediate — check the "True Format" result at the top.
  3. 3Scroll the hex view to examine the raw byte content.
  4. 4Switch to the Strings tab to see all extracted human-readable content.
  5. 5Use the search bar in the Strings view to look for specific keywords like "password" or "http".

🎯 Who Uses This

  • ▸IT security teams analyzing suspicious email attachments before opening them
  • ▸Forensic investigators examining file evidence for authenticity and hidden content
  • ▸Malware analysts performing initial triage on unknown executable files
  • ▸Developers debugging binary file format issues and parsing problems
  • ▸CTF competitors examining binary challenge files for hidden flags and strings

Frequently Asked Questions

Q: What are "magic bytes"?
Magic bytes (also called file signatures or magic numbers) are specific byte sequences at the beginning of a file that identify its format. For example, PDF files always start with %PDF-, JPEG files start with FF D8 FF, PNG files start with 89 50 4E 47. Checking magic bytes rather than file extensions reveals the true format regardless of how the file is named.
Q: Can it detect files with multiple embedded file types?
Yes. The byte scanner searches the entire file for embedded magic byte sequences, not just the beginning. A PDF file containing an embedded ZIP archive will show both signatures. This is how polyglot files — files that are valid in multiple formats simultaneously — are detected.