Skip to main content
Tool Factory

Forensics & Binary

Embedded Files Scanner

Scan the supplied data for embedded Files. Add the content, choose the checks, and review the reported details.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

Run the tool when your input is ready.

Options

Your result appears here

Scan the supplied data for embedded Files. Add the content, choose the checks, and review the reported details.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

Embedded Files Scanner performs embedded-file scanning on supplied binary or media data. The operation returns detected embedded-file records or extracted file data. This result is specific to Embedded Files Scanner's selected byte or media interpretation.

The operation returns detected embedded-file records or extracted file data. This result is specific to Embedded Files Scanner's selected byte or media interpretation. This result runs in the browser for this catalog category. Processing runs in the browser.

Embedded-file analysis reports or copies byte ranges; it does not make extracted content safe or attribute its source.

Instructions

  1. Provide file or files for this tool.
  2. Use a copy of an authorized sample. This applies to Embedded Files Scanner.
  3. Record offsets, lengths, and file names with extracted results. This applies to Embedded Files Scanner.
  4. Validate each extracted file independently before opening it. This applies to Embedded Files Scanner.

Example

Input: A disposable PNG or binary sample with a known embedded text file. Operation: Embedded Files Scanner.

Settings: Embedded Files Scanner: Provide a supported image or binary file. Select the documented scan, extraction, or output option. Use a bounded sample before processing a large file.

Result: The operation returns detected embedded-file records or extracted file data. This result is specific to Embedded Files Scanner's selected byte or media interpretation.

Limits

  • Embedded Files Scanner: Detection can miss unknown, compressed, encrypted, or malformed payloads.
  • Embedded Files Scanner: Extracted files can contain malicious content.
  • Embedded Files Scanner: A detected payload does not prove who embedded it or when.

Questions

What input does Embedded Files Scanner accept?

Embedded Files Scanner accepts binary data or a selected file.

Does Embedded Files Scanner need extra settings?

Embedded Files Scanner does not define extra operation settings. It uses its built-in behavior with the supplied input.

What does Embedded Files Scanner return?

Embedded Files Scanner returns text. Scans the data for potential embedded files by looking for magic bytes at all offsets. This operation is prone to false positives. WARNING: Files over about 100KB in size will take a VERY long time to process.