binwalk and carving

02A hit is a place to look

A scanner match points to a place worth inspecting. It can be a fragment or an accidental pattern and may not show where a valid object ends. A complete-format reader checks more structure. Extraction can also invoke helper programs, so finding a signature and enabling extraction are separate decisions.

The historical course record reports Binwalk v2.3.3 classifying a PNG at offset 5 and zlib-compressed data at 46. zlib is a compression format that can occur inside PNG data; another signature does not automatically mean another independent complete file. The recorded scan remains separate from scan.txt’s author-placement explanation.

03Read the author offset

Trace the five supplied prefix bytes without running a scanner or carving source.

Label: author offset card. Not a binwalk transcript.
Historical 2026-10-12 QA separately reports PNG at offset 5 and zlib data at offset 46. The placement card below remains authored evidence, not scanner output.

File: combined.bin
Prefix: the five bytes 4e 4f 54 45 0a, which are the letters NOTE and a line feed.
PNG signature starts at offset 5: 89 50 4E 47 0D 0A 1A 0A
The bytes from offset 5 are the same small PNG as benign-note.txt, placed there for this lesson.
A signature at a known offset is a candidate range. It is not a parser's verdict.
The author card and that signature scan name the same PNG offset. This card does not decode the image.

"""Print the first eight bytes at offset 5. Authoring did not run this file.

Default action: print hex. It does not write a carved file.
A later run, if separately authorized, uses a copy of combined.bin in a new directory.
"""
from pathlib import Path


def main():
    data = Path("combined.bin").read_bytes()
    piece = data[5:13]
    print(piece.hex())


if __name__ == "__main__":
    main()

1. Number 4e 4f 54 45 0a as positions 0,1,2,3,4. The final 0a is a line feed.
2. Locate the next position, 5, and compare its eight bytes with the PNG reference.
3. Read data[5:13] in carve.py: Python slicing includes position 5 and stops before 13, giving eight bytes. The script prints that range as hex and does not write a carved file.
4. Stop with the candidate-start note. A later appropriate reader would need the complete object, not only these eight bytes.

04Optional challenge

For about ten optional minutes, list the byte positions covered by the slice 5:13 and copy the eight displayed bytes. Your note should say that a header-sized slice can support a signature observation but cannot establish the rest of the image.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

File: packet.bin. Byte offsets start at zero.
Prefix bytes: 50 41 43 4b 45 54 0a. Each pair is one byte.
Immediately after the prefix comes the eight-byte signature 89 50 4e 47 0d 0a 1a 0a.
This card records author placement, not scanner output. Only a candidate start is established.

B1: an author describes placing a header after a prefix.
B2: a saved scanner result reports a matching signature at an offset.
B3: a suitable full reader accepts a bounded copied object’s complete structure.
These are different kinds of evidence. No new scan or reader run occurs here.

A signature starts at zero-based offset 9. The inspection needs exactly its 8 bytes, no more.
Python slice notation start:stop includes start and excludes stop.
This is a paper plan for reading a copied buffer, not carving or execution.

06Explain the evidence and its limit

Optional self-check: write source, zero-based offset, proposed range and a missing full-reader check for an embedded signature.

Review it: count bytes rather than hex characters, distinguish author placement from a scanner transcript, and do not infer completeness or automatic extraction permission from a hit.