Files and metadata: what a file tells you
You identify files by content rather than extension, read author and time from metadata, and spot data hidden inside files with simple tools.
Level 101 · 14 lessons · 12 practice labs
Lessons
Identifying files
- Magic bytes: how the file command identifies a file
- Looking at a file header in hex with xxd
- Finding files whose extension lies
- Container formats: docx, xlsx and apk are really zips
- Short task: sort out the mislabelled files in a folder
Metadata
- Photo metadata with ExifTool: device, date, location
- Author, company and edit history in Office and PDF files
- Comparing file system times with in-document times
- Stripping metadata from documents that leave the organisation
- Short task: find who a leaked document came from using metadata
Hidden data
- Data appended to files: detecting it with binwalk
- What steganography is and why it is hard to detect
- Simple hidden data checks with steghide and zsteg
- Capstone: find and report data hidden in an employee’s folder
Practice labs
- Find the file type from magic bytes: Determine the real type of five files from their header bytes with file and xxd.
- Weed out misnamed files: Find the files in a folder whose extension does not match their content and list them with the right types.
- Look inside container formats: Open a docx and an apk file as archives and show the document and manifest files inside.
- Read a photo's metadata: Extract a photo's device, capture date and location with ExifTool.
- Who the leaked document came from: Find the document's origin from the author, company and last-modified-by fields of an office file.
- Compare file system and in-document times: Find the mismatch between internal creation time and file system time of three documents and write the likely explanation.
- List what metadata a document holds: List a PDF's metadata fields and mark the ones that should not leave the organisation.
- Clean a document before it goes out: Remove author, location and edit history from three Sedirli Hukuk Bürosu documents and verify the result.
- Audit what is left after cleaning: Find the embedded thumbnail, comments and hidden layers left in a cleaned document.
- Find data appended to a file: Detect and extract the archive appended to an image with binwalk.
- A simple hidden data check: Check five images with steghide and zsteg and find the one carrying data.
- Find and report data hidden in a folder: Find three pieces of data hidden in an employee folder by extension, metadata and end-of-file techniques and write a short report.
About this course
You identify files by content rather than extension, read author and time from metadata, and spot data hidden inside files with simple tools.
What you will learn
- Identifying files
- Metadata
- Hidden data
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.