A security guide to interpreting local file triage based on filenames, MIME, magic bytes, double extensions, entropy, and bounded content samples.
Turn the guide into a safe trial
Complete the steps with a synthetic example before using real data. Checkmarks live only in this tab.
A filename is a signal, not proof
Double extensions such as report.pdf.js can present a document-like name while the final extension remains executable. Dots, spaces, look-alike Unicode characters, and excessive length can obscure the visible type. These signals increase suspicion but do not prove malware.
An allowlist accepts only the small set of formats a workflow actually needs. Browser triage can normalize the name, extract the final extension, and report risky combinations without opening the file. Renaming does not change content, so further checks remain necessary.
Why compare MIME and magic bytes?
The MIME value reported by a browser can come from the file or operating system and is not sufficient for a security decision. Magic bytes identify the opening signature of formats such as PDF, PNG, JPEG, ZIP-based Office documents, and some executables.
A .jpg extension with a PDF or executable signature is a meaningful mismatch. Polyglot files and malformed or proprietary formats can still defeat simple rules. Signature checking is not a complete parser or sandbox.
- Treat extensions as interface hints.
- Do not treat MIME as security proof.
- Compare signatures with a narrow type allowlist.
- Use mismatches to stop automatic processing.
What bounded sampling can find
Sampling the beginning and end as text can expose obvious markers such as encoded PowerShell commands, script tags, macro relationships, or a shebang. Size limits and bounded reads provide fast triage without loading an entire large file into memory.
The method can miss compressed archive members, encrypted payloads, obfuscation, or content in an unsampled middle section. High entropy may indicate compression or encryption; it is not a malware verdict. No finding never means the file is safe.
A safer decision workflow
Do not open a suspicious file, preview it, or enable macros. Verify the source, keep it quarantined, and use current professional anti-malware or a controlled sandbox for independent analysis. An organization's incident procedure takes priority.
Local triage avoids unnecessary third-party upload, but the selected file is still read in browser memory. Process personal or confidential material only with authorization. A SHA-256 digest can compare integrity; it does not authenticate origin or safety.
Sources and verification
The following primary and official documentation was checked for this guide. Review each source's current version and change date as well.
Turn the guide into a repeatable review
Use this 3-tool review plan for “Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits”. Goal: A security guide to interpreting local file triage based on filenames, MIME, magic bytes, double extensions, entropy, and bounded content samples. Start with a safe example instead of real data, then record each expected result and acceptance decision.
Local File Risk Pre-Scan
- Prepare
- Choose only a file you are authorized to inspect. Expected format for Local File Risk Pre-Scan: For Local File Risk Pre-Scan, provide local file or files of a supported type within the disclosed size limit. The requested outcome is to inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading..
- Apply
- Run the size-bounded local scan; the file is never opened or executed. Local File Risk Pre-Scan applies this method: Local File Risk Pre-Scan uses this disclosed method to inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading: the file is read in browser memory and a new output is created without overwriting the original.
- Acceptance check
- If findings are suspicious, isolate the file and verify with a current professional security product. Acceptance check for Local File Risk Pre-Scan: Before accepting a Local File Risk Pre-Scan result, complete preserving the original and checking that output opens correctly, retains expected pages or frames, size, and visible quality; the evidence should support the goal to inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading..
- Expected output
- When Local File Risk Pre-Scan finishes, it returns a downloadable new file, size and format metrics, and disclosed processing limits, organised around the goal to inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading.. Inspect extension, signature, double extension, macro indicators, and bounded content samples without uploading.
EXIF / Metadata Cleaner
- Prepare
- Select a JPEG or PNG up to 25 MB from your device. Expected format for EXIF / Metadata Cleaner: For EXIF / Metadata Cleaner, provide local file or files of a supported type within the disclosed size limit. The requested outcome is to inspect sensitive JPEG and PNG metadata locally and download a clean copy..
- Apply
- Review detected metadata and image dimensions. EXIF / Metadata Cleaner applies this method: EXIF / Metadata Cleaner uses this disclosed method to inspect sensitive JPEG and PNG metadata locally and download a clean copy: the file is read in browser memory and a new output is created without overwriting the original.
- Acceptance check
- Generate and download the clean copy, then re-scan it if needed. Acceptance check for EXIF / Metadata Cleaner: Before accepting a EXIF / Metadata Cleaner result, complete preserving the original and checking that output opens correctly, retains expected pages or frames, size, and visible quality; the evidence should support the goal to inspect sensitive JPEG and PNG metadata locally and download a clean copy..
- Expected output
- When EXIF / Metadata Cleaner finishes, it returns a downloadable new file, size and format metrics, and disclosed processing limits, organised around the goal to inspect sensitive JPEG and PNG metadata locally and download a clean copy.. Inspect sensitive JPEG and PNG metadata locally and download a clean copy.
SHA-256 Digest Generator
- Prepare
- Enter text. Expected format for SHA-256 Digest Generator: For SHA-256 Digest Generator, provide synthetic or minimized code, configuration, identifiers, or file content you are authorized to review. The requested outcome is to calculate a SHA-256 integrity digest with Web Crypto..
- Apply
- Run the SHA-256 calculation. SHA-256 Digest Generator applies this method: SHA-256 Digest Generator uses this disclosed method to calculate a SHA-256 integrity digest with Web Crypto: content is not executed; only explainable static patterns and bounded browser operations are applied.
- Acceptance check
- Verify identical input returns the same digest. Acceptance check for SHA-256 Digest Generator: Before accepting a SHA-256 Digest Generator result, complete manual review at the source location and independent verification with an appropriate professional security tool or authorized process; the evidence should support the goal to calculate a SHA-256 integrity digest with Web Crypto..
- Expected output
- When SHA-256 Digest Generator finishes, it returns evidence locations, severity, false-positive considerations, and the next verification action, organised around the goal to calculate a SHA-256 integrity digest with Web Crypto.. Calculate a SHA-256 integrity digest with Web Crypto.
Apply this boundary to Local File Risk Pre-Scan: Local File Risk Pre-Scan limitation: Code is not executed, and no finding does not prove the absence of vulnerabilities. If that condition is not met, do not pass the output to the next workflow step.
For “Browser File Risk Scanning: Magic Bytes, Double Extensions, and Real Limits”, record the tool, selected setting, browser version, and acceptance or rejection reason for “Initial triage of a downloaded file: local analysis with Local File Risk Pre-Scan”—not the sensitive content. This keeps the review repeatable without copying real data.
Content is checked against visible ByteQuant product behavior and the listed primary sources where available. It is general information, not legal or security advice.