0
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

File Signature Using Hex editor to know what the exactly file type is & Shift bit - Extensionが変更されているファイル判断

Last updated at Posted at 2018-02-19

Example:secret_file.jpg

when you open the file and Windows Photo Viewer is unable to open the file correctly, because this is not a picture file,

1.Download Hex editor as you like.

2.File open in Hex Editor and then look at begging of file bits.These beginning bits of file is called the file signature.(Magic Number)
Example if your file is 50, 4B, 03, 04, 14, 00, 06, 00.

Search this number in google or below.

https://www.garykessler.net/library/file_sigs.html

informations said that
50 4B 03 04 14 00 06 00 PK......

DOCX, PPTX, XLSX Microsoft Office Open XML Format (OOXML) Document

3.Now you understand this .jpg file is maybe MS office format.

4.change the extension as secret_file.jpg -> secret_file.docx.

5.Now you can open the file to view. 

結論:Hex Editorを使って、拡張子不明なファイルを開く、
その際、先頭の2byteにあるFile Signatureから検索し、
ファイルの種類を識別することが可能。

追加:開いたファイルが正しく参照できない場合。
shift bit To read unreadable character file.
Just shift bit to left or right in Hex Editor if you look unreadable file which character is broken by someone.

例:secret.txtというファイルが存在し、開くと文字化けが発生。

Hex Editorで開くと以下の通り。
A8D0D2E640D2E640C240E8CA737421 ....@..@.@..st!

その場合は、shift bit を左か右にしてみる。

結果:右にシフトすると、不明だったものが見えてくる。
546869732069732061207465737421 This is a test!

*Treat Data as:32bit unsigned long
Byte Ordering :Little Endian.

0
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
0
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?