Hexadecimal and File Signatures
Where you are: Part II — The Technical Foundations · Lesson 2.2 · This lesson follows Chapter 2.3 of Dr. Al-Doori's IT Forensics Essentials: hexadecimal.
What you'll be able to do
By the end of this lesson you will be able to read the hexadecimal that forensic tools show you, and use file signatures to identify what a file really is.
- Count and convert between decimal, binary and hexadecimal.
- Explain why one hexadecimal digit is four bits and two digits are one byte.
- Read a file signature and spot a file whose extension does not match its contents.
Why Forensics Speaks Hexadecimal
The book explains that hexadecimal is everywhere in computer forensics: in the way hash values are written, the way file signatures are referenced, and the way drives are searched byte by byte. Forensics works at the level of bits and bytes, and long strings of ones and zeros are almost impossible for people to read. Hexadecimal compresses them into a readable form.
Counting in Base 16
Our everyday decimal system is base 10: ten digits, 0 to 9. Hexadecimal is base 16: it needs sixteen digit symbols, so after 0 to 9 it uses the letters A to F for the values ten to fifteen.
Decimal 0 1 ... 9 10 11 12 13 14 15 16 17 18
Hexadecimal 0 1 ... 9 A B C D E F 10 11 12
When you run out of digits you carry, just as in decimal: after F comes 10, which means one sixteen and no units, so hex 10 is decimal 16. Upper- and lower-case letters mean the same thing: ff and FF are identical. You will often see hex written with a 0x prefix, as in 0xFF, to make clear it is not decimal.
Some values worth recognizing:
Decimal 15 16 255 256 512 1,024 4,096
Hexadecimal F 10 FF 100 200 400 1000
Bits, Nibbles and Bytes
The real reason hex is so convenient is that one hexadecimal digit represents exactly four binary digits (bits). Four bits are called a nibble, half of a byte (eight bits). So a byte is always exactly two hex digits, from 00 to FF, which is 0 to 255 in decimal.
Hexadecimal 1 F 10 1F FF
Binary 0000 0001 0000 1111 0001 0000 0001 1111 1111 1111
Decimal 1 15 16 31 255
Each half-byte maps neatly onto one hex digit: F is 1111, and so FF is 1111 1111. That is why memory addresses and the raw contents of disks are almost always shown in hex.
Converting by Hand, and by Calculator
Each position in a hex number is worth sixteen times the position to its right: 1, 16, 256, 4,096 and so on. The book works through the number 2AF3:
- 2 × 4,096 = 8,192
- A (10) × 256 = 2,560
- F (15) × 16 = 240
- 3 × 1 = 3
Total: 10,995. You can do this by hand, but you do not need to. The Windows Calculator has a Programmer view that converts between hex, decimal and binary instantly, and most scientific calculators can do the same.
File Signatures: What a File Really Is
Anyone can rename a file. Right-click, type a new name and extension, and a spreadsheet can be called holiday.jpg. But most file types begin with a fixed sequence of bytes called a file signature (or "magic number"), and changing that is much harder for a casual user. Forensic tools read the signature, not the name.
The book's example is the classic Microsoft Word .doc file, which always begins with D0 CF 11 E0, whatever it is called. Other legacy Office files, such as .xls and .ppt, share this signature, so a tool must look inside the file to tell them apart. Some other signatures you will meet constantly:
File type First bytes (hex) As text
PDF document 25 50 44 46 %PDF
JPEG image FF D8 FF
PNG image 89 50 4E 47 0D 0A 1A 0A .PNG....
ZIP archive (also .docx, 50 4B 03 04 PK..
.xlsx and .pptx)
Windows program (.exe) 4D 5A MZ
Many forensic programs run signature analysis automatically and flag every file whose signature does not match its extension. A "text file" that starts with FF D8 FF is really a JPEG image, and someone may have renamed it to hide it.
Try It: See a File's Signature (Optional)
On your own computer, pick a photo you took and a PDF you own. View the first bytes in hex:
- Windows (PowerShell):
Format-Hex .\photo.jpgand look at the first row of the output. - macOS or Linux (Terminal):
xxd photo.jpg | head -1
You should see the signature from the table above. Now copy the photo, rename the copy photo.txt and look again: the name changed, the signature did not.
Real-World Example
Imagine (a fictional scenario) an examiner reviewing a company laptop in an investigation into leaked product photos. The user's documents folder contains a file called Q3_budget_FINAL.xlsx that will not open in a spreadsheet program. Signature analysis flags it: its first bytes are FF D8 FF, the signature of a JPEG image. Viewed as an image, it is one of the leaked product photos. The examiner reports the mismatch and the signature evidence, and notes that the renaming itself suggests an attempt to hide the file, without overstating who did it.
From the Book to 2026
What the book teaches. Hexadecimal is base 16; one hex digit is four bits and two digits are a byte. The book adds that a hard drive's standard physical sector is 256 bytes, which matches FF in hexadecimal. It also teaches that a Word .doc file always has the signature D0 CF 11 E0.
Why it made sense. The hex teaching and the signature principle are completely sound. The sector remark was meant to show why hex values line up so neatly with storage.
What has changed. Two refinements. First, the sector size is an erratum. FF is 255, and 256 is hex 100. Hard drive sectors have traditionally been 512 bytes (hex 200), and modern "Advanced Format" drives use 4,096-byte physical sectors (hex 1000), as Microsoft's support policy for these drives documents. Many of them still present 512-byte logical sectors to the computer ("512e"), so a tool may show 512 even on a modern drive. Lesson 2.3 builds on this. Second, D0 CF 11 E0 is still the signature of the legacy .doc format, but modern Word files (.docx), like .xlsx and .pptx, are ZIP containers that begin with 50 4B 03 04 ("PK"). A forensic tool has to look inside the ZIP to read them.
What to do now. Use the signature, never the extension, to decide what a file is, and keep a signature reference such as Gary Kessler's public file-signature table (now hosted by SEARCH) to hand. Remember that 512 and 4,096 bytes, not 256, are the sector sizes you will see.
Watch: Why Programmers Use Hexadecimal
In this short video, Jacob Sorber, a computer science professor, explains why programmers use hexadecimal numbers.
Questions to keep in mind as you watch:
- How does the link between one hex digit and four bits make binary data easier to read?
- Where do you see hex values in everyday computing, and how might each appear in a forensic tool?
- Can you convert one of the presenter's examples yourself, using the method in this lesson?
The video complements what you just read. The lesson is complete without it.
What Would You Do?
In an investigation into a fraud, signature analysis flags 40 files whose extensions do not match their signatures. A colleague says: "The suspect must have hidden all 40 on purpose. Put that in the report." What would you check before agreeing? Decide, then compare with the model answer in the note below.
Knowledge Check
What is the decimal value of hexadecimal 1F?
A file called notes.txt begins with the bytes 25 50 44 46. What is it most likely to be?
Why is one byte always written as exactly two hexadecimal digits?
Answers explained
- Question 1: b. 1F is one sixteen plus fifteen units: 16 + 15 = 31. Option a is F alone, and option c is hex 10.
- Question 2: d. 25 50 44 46 is "%PDF", the PDF signature, whatever the extension says. A JPEG begins FF D8 FF, and a Windows program begins 4D 5A.
- Question 3: b. Four bits per hex digit, eight bits per byte, so two digits. A byte has 8 bits, not 16 (a), and hex is not limited to 99 (c).
On "What Would You Do?": Check each mismatch before drawing conclusions. Some mismatches are innocent: programs routinely create files with unusual extensions, and an .xlsx that shows a ZIP signature is perfectly normal. Look at what each file actually contains, where it was stored, and its timestamps and history. Report the mismatches that are relevant, explain what they show, and say only "the file had been renamed or given a misleading extension" unless other evidence shows who did it and why.
Key Takeaways
- Hexadecimal is base 16: 0–9, then A–F for ten to fifteen. Hex 10 is decimal 16, and FF is 255.
- One hex digit is four bits (a nibble). Two hex digits are one byte, from 00 to FF.
- File signatures identify the real file type whatever the name: D0 CF 11 E0 for legacy Office files such as .doc, 25 50 44 46 for PDF, FF D8 FF for JPEG, 50 4B 03 04 for ZIP and modern Office files.
- Sectors are 512 bytes (hex 200) traditionally and 4,096 bytes (hex 1000) physically on modern drives, many of which still present 512-byte sectors to the computer; they are not 256.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.3
- GCK's File Signatures Table (Gary Kessler, hosted by SEARCH)
- Microsoft Learn — Microsoft support policy for 4K sector hard drives in Windows
- Microsoft Learn — Format-Hex
- NIST — IR 8354: Digital Investigation Techniques: A NIST Scientific Foundation Review (November 2022)