LAB // 01 · STATIC DIGITAL FORENSICS

ByteWitness

Inspect what a file says about itself before anyone asks it to run. ByteWitness examines bytes, structure, metadata, strings, entropy, and embedded-file candidates entirely inside your browser.

Drop a file into the evidence bay

or choose a file from this device. Recommended maximum: 64 MB.

Choose file

Static analysis cannot establish that a file is safe or malicious. Findings are observations intended to support further investigation.

WHAT BYTEWITNESS CHECKS

File extension versus observed magic bytes

SHA-256 and SHA-1 identifiers

Printable ASCII / UTF-16LE strings

Overall and block entropy

Embedded PDF, ZIP, image, ELF, SQLite, audio, and validated PE-like signatures

PDF actions, embedded-file markers, EOF and trailing data

PNG/JPEG boundaries and image least-significant-bit views

WAV/RIFF chunks, MP3 ID3 metadata, FLAC/Ogg container markers

EVIDENCE STANDARD

ByteWitness reports what is observable. A valid secondary executable structure inside a document or audio file is stronger evidence than the letters “MZ” appearing by coincidence. Suspicion is not attribution, and unusualness is not proof of compromise.