Forensics & Binary
Files Extractor
Find and collect files from the supplied input. Add the content, choose the checks, and review the reported details.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
Files Extractor performs signature-based file carving on supplied binary or media data. It scans for supported signatures and returns extractable files that meet the minimum size.
It scans for supported signatures and returns extractable files that meet the minimum size. This result runs in the browser for this catalog category. Processing runs in the browser.
Embedded-file analysis reports or copies byte ranges; it does not make extracted content safe or attribute its source.
Instructions
- Provide file or files for this tool.
- Keep the original binary sample unchanged during analysis. This applies to Files Extractor.
- Lower Minimum File Size only when investigating a known smaller embedded file. This applies to Files Extractor.
Example
Input: Use a disposable binary sample containing a complete embedded PNG larger than 100 bytes.
Settings: Files Extractor: Enable the relevant file-signature category and set Minimum File Size in bytes. Ignore failed extractions suppresses supported extraction errors; it does not repair damaged files.
Result: It scans for supported signatures and returns extractable files that meet the minimum size.
Limits
- Files Extractor: Finding a signature does not guarantee that a complete file exists at that offset.
- Files Extractor: Unsupported formats and fragmented files can remain unextracted; this is not general filesystem recovery.