Is there a file format equivalent of Wireshark?

Question

I love how Wireshark breaks down every packet by protocol section, explaining what every single bit and byte is for. What I would also love is a program that does the same thing for regular files: showing a hex dump of each file and identifying headers, data sections, etc. and what they do. E.g. it would know the format of JPG, GIF, PNG, word docs, EXIF segments of photos, etc. Is there any such thing?

Answer 1

No, but that sounds like an excellent open source project to start on.

The problem comes in that wireshark is able to do it because protocols don't change much (they can't; applications wouldn't be able to keep up and interoperability wouldn't happen). This isn't true of file formats, however, which have the annoying tendency to change more frequently.

You should check out the 'file' command (if you haven't yet) which identifies files quite well. Then you could pull in some programs like identify from the ImageMagick suite which could help you break down files.

But then you'll quickly realize that every single library must be pulled in because files are huge and complex and not simple to break down in the first place (unlike packets). That's the whole reason that applications are so large in the first place! To manipulate those nasty files!

Answer 2

Well, files are actually identifiable by 'magic numbers' or specific file header sequences. In unix, there is a built in tool called file. Alternately there's a tool called trid that does the same thing.

There's an article on the forensics wiki that lists a fair number of other tools that you could use, if these fail.