A security guide to interpreting local file triage based on filenames, MIME, magic bytes, double extensions, entropy, and bounded content samples.
A filename is a signal, not proof
Double extensions such as report.pdf.js can present a document-like name while the final extension remains executable. Dots, spaces, look-alike Unicode characters, and excessive length can obscure the visible type. These signals increase suspicion but do not prove malware.
An allowlist accepts only the small set of formats a workflow actually needs. Browser triage can normalize the name, extract the final extension, and report risky combinations without opening the file. Renaming does not change content, so further checks remain necessary.
Why compare MIME and magic bytes?
The MIME value reported by a browser can come from the file or operating system and is not sufficient for a security decision. Magic bytes identify the opening signature of formats such as PDF, PNG, JPEG, ZIP-based Office documents, and some executables.
A .jpg extension with a PDF or executable signature is a meaningful mismatch. Polyglot files and malformed or proprietary formats can still defeat simple rules. Signature checking is not a complete parser or sandbox.
- Treat extensions as interface hints.
- Do not treat MIME as security proof.
- Compare signatures with a narrow type allowlist.
- Use mismatches to stop automatic processing.
What bounded sampling can find
Sampling the beginning and end as text can expose obvious markers such as encoded PowerShell commands, script tags, macro relationships, or a shebang. Size limits and bounded reads provide fast triage without loading an entire large file into memory.
The method can miss compressed archive members, encrypted payloads, obfuscation, or content in an unsampled middle section. High entropy may indicate compression or encryption; it is not a malware verdict. No finding never means the file is safe.
A safer decision workflow
Do not open a suspicious file, preview it, or enable macros. Verify the source, keep it quarantined, and use current professional anti-malware or a controlled sandbox for independent analysis. An organization's incident procedure takes priority.
Local triage avoids unnecessary third-party upload, but the selected file is still read in browser memory. Process personal or confidential material only with authorization. A SHA-256 digest can compare integrity; it does not authenticate origin or safety.
Turn the guide into a safe trial
Test the steps in “Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits” with synthetic data in Local File Risk Pre-Scan before using live material. Checkmarks remain only in this tab.
Sources and verification
“Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits” was checked directly against 2 primary or official sources. Before applying it, confirm the current version and change date at each linked source.
Turn the guide into a repeatable review
Use this 3-tool review plan for “Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits”. Goal: A security guide to interpreting local file triage based on filenames, MIME, magic bytes, double extensions, entropy, and bounded content samples. Start with a safe example instead of real data, then record each expected result and acceptance decision.
Local File Risk Pre-Scan
- Prepare
- Choose only a file you are authorized to inspect.
- Apply
- Run the size-bounded local scan; the file is never opened or executed.
- Acceptance check
- If findings are suspicious, isolate the file and verify with a current professional security product.
- Expected output
- a downloadable new file, size and format metrics, and disclosed processing limits. Inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading.
EXIF / Metadata Cleaner
- Prepare
- Select a JPEG or PNG up to 25 MB from your device.
- Apply
- Review detected metadata and image dimensions.
- Acceptance check
- Generate and download the clean copy, then re-scan it if needed.
- Expected output
- a downloadable new file, size and format metrics, and disclosed processing limits. Inspect sensitive JPEG and PNG metadata locally and download a clean copy.
SHA-256 Digest Generator
- Prepare
- Enter text.
- Apply
- Run the SHA-256 calculation.
- Acceptance check
- Verify identical input returns the same digest.
- Expected output
- evidence locations, severity, false-positive considerations, and the next verification action. Calculate a SHA-256 integrity digest with Web Crypto.
Apply this boundary to Local File Risk Pre-Scan: Code is not executed, and no finding does not prove the absence of vulnerabilities. If that condition is not met, do not pass the output to the next workflow step.
For “Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits”, record the tool, selected setting, browser version, and acceptance or rejection reason for “Initial triage of a downloaded file”—not the sensitive content. This keeps the review repeatable without copying real data.
“Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits” was prepared by comparing visible ByteQuant behavior for file security with the 2 listed primary sources. Its limits and acceptance criteria support review; they do not replace legal or security advice.