File formats like PNG, JPEG, and ZIP have well-defined end markers — but nothing stops extra data from being appended after that marker, since most viewers stop reading once they've rendered the image or listed the archive. CTF forensics challenges exploit this constantly: a perfectly normal-looking photo that's secretly a photo plus a hidden ZIP file glued onto the end. binwalk is built specifically to spot that kind of embedded data and pull it back out.
1. Scan for embedded signatures
Point binwalk at the file with no extra flags first — it scans the whole thing for known file-format signatures (ZIP headers, other image formats, executables, compressed archives) regardless of where they sit in the file:
binwalk challenge.pngA clean, single-purpose file shows one entry near the very start. A file with something hidden shows a second signature partway through — commonly a ZIP local file header (PK\x03\x04) sitting well past where the visible image data should have ended.
2. Extract what it finds
The -e flag tells binwalk to actually carve out and save every signature it identified, not just report them:
binwalk -e challenge.pngThis creates a _challenge.png.extracted/ directory containing each embedded file as its own separate output. Check that directory for anything with a recognizable extension or file type — running file on each extracted item quickly tells you what you're actually holding.
3. When automatic extraction isn't enough
Binwalk's signature database doesn't catch everything, and some embedded data is deliberately placed to confuse it. If -e comes up empty but you suspect something's there, fall back to inspecting the raw bytes directly:
xxd challenge.png | tail -50
foremost challenge.pngxxd lets you eyeball the tail of the file for a signature binwalk's database might have missed; foremost is a second carving tool with its own signature set and is worth trying as a cross-check when binwalk alone doesn't find anything.
4. A quick checklist
- Run
binwalkwith no flags first — a second signature after the main one is the tell. binwalk -eto carve everything out automatically.fileevery extracted item to identify it before opening it.- If nothing turns up, cross-check with
foremostor a manualxxdlook at the file's tail.
Wrapping up
"Check whether there's a second file hiding inside the one you were given" is one of the highest hit-rate moves in CTF forensics, and binwalk automates almost all of it. Our PicoCTF Hideme writeup walks through exactly this technique end to end on a real challenge, and the Getting Started with CTF guide covers where it fits alongside other forensics tools.