Inspect files as layered containers with signatures, indexes, relationships, metadata, embedded objects, revisions, chunks, markers, and parser-dependent behavior.
Document forensics begins by treating a PDF, Office file, PNG, or JPEG as a structured container rather than trusting its extension or rendered appearance; structural inspection, validation, cryptographic verification, rendering, and sanitization are separate operations.
The submitted report remains byte-identical. This separate review, checked 2026-08-26, narrows implementation claims and gives visitors a decision path before they generalize from a local result.
Output produced deterministically by the local runtime.
Useful model or subset that must not be mistaken for full conformance.
Conclusion that needs an exact implementation, trust system, model, parser, or human review.
| Question | What the local page can answer | What it does not establish | Next evidence step |
|---|---|---|---|
| What allowlisted container does the file resemble? | The lab reports signature and structural evidence. | Complete format conformance or application behavior. | Validate with independent strict parsers and preserve the original hash. |
| Does the container expose selected risky structures? | Yes — within the bounded parser coverage. | Malware execution, exploitability, or semantic harm. | Escalate to isolated rendering and specialist analysis. |
| Is a signature trustworthy? | No — signature-related structures may be inventoried only. | Cryptographic validity, identity, revocation, or policy. | Use a dedicated verifier with trust and timestamp policy. |
Exercises type detection, container mapping, metadata inventory, and no-execution boundaries.
Expected boundary: Each fixture produces deterministic structural findings and no external effect.
Open prepared laboratoryNo single view is automatically authoritative. Preserve the source, identify each parser or receiver, and compare their outputs before authorizing a consequential decision.
Filename, extension, declared media type, magic bytes, and digest.
ZIP entries, PDF objects and revisions, PNG chunks, or JPEG markers.
Info dictionaries, properties, EXIF, XMP, comments, and textual chunks.
Internal and external package links, embedded files, and attachments.
Macros, JavaScript, actions, forms, and executable relationships.
A newly constructed representation after approved stripping or flattening.
The workflow preserves evidence before transformation and keeps structural inspection separate from execution, remote verification, or model behavior.
These controls are contextual. They reduce a defined risk; they do not guarantee safety, truth, attribution, or resistance to every adaptive attack.
Require local/central ZIP record agreement and non-overlapping spans.
Bound total and per-entry expansion before decompression.
Never follow external OOXML relationships during inspection.
Parse all PDF revisions and distinguish signature validity from allowed modifications.
Compare EXIF, XMP, thumbnails, and visible pixels as separate evidence sources.
Definitions are linked into the site-wide glossary and back to the full report.
A format that encapsulates multiple data streams, objects, metadata fields, or relationships.
An IANA identifier describing a representation format, distinct from a filename extension.
The ZIP record immediately preceding one compressed entry.
The ZIP index near the end of an archive that points to local entries.
An OPC relationship connecting OOXML parts internally or externally.
A PDF revision appended without rewriting earlier bytes.
A non-critical PNG chunk carrying optional metadata or rendering information.
An XML-based metadata framework used across PDF and image formats.
Camera and image metadata stored in JPEG, TIFF, and other containers.
A security-relevant difference between how independent parsers interpret the same bytes.
These links are provided for visitors who want the governing specification, paper, framework, or implementation documentation. Links open in a new tab; the site does not fetch them during runtime analysis.
PDF 2.0 specification and supporting material.
Normative or first-party specification material.OOXML and Open Packaging Conventions.
Normative or first-party specification material.PNG signature, chunks, conformance, and security considerations.
Normative or first-party specification material.XMP data model and serialization.
Normative or first-party specification material.Current EXIF specifications.
Normative or first-party specification material.Authoritative media-type registry.
First-party guidance, framework, registry, or standards-program material.Historical PDF editions and reference material.
Useful supporting material that does not replace the governing specification or original study.The full submitted report is preserved byte-for-byte in the governed research library and in durable repository documentation. The laboratory turns selected concepts into deterministic local output without external calls or hidden persistence.
A structural analysis of file signatures, ZIP ambiguity, OOXML relationships, PDF objects and revisions, image chunks, EXIF/XMP conflicts, parser differentials, sanitization, and safe inspection boundaries.
Read governed reportInspect a PDF, OOXML, PNG, or JPEG as inert bytes, identify its format, compute a digest, map structural features, and report active-content and ambiguity indicators.
Open bounded laboratory