---
title: "Binary and file triage"
description: "Form static-analysis hypotheses from bytes without executing or uploading a sample."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.serialize.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Binary and file triage

## Learning objectives

- Move safely between hex text and raw bytes
- Recognize a file signature as a hypothesis, not proof of safety
- Extract printable strings from binary data
- Identify compression layers
- Read a short disassembly without executing code

## Station 1: bytes and signatures

Start with [Hexadecimal to text](/recipes/encoding/hex-to-text/) to confirm how displayed byte pairs become raw bytes.

Then install [Detect a file type from its header](/recipes/binary-files/detect-file-type/). The sample contains a PNG signature and the beginning of an IHDR chunk. Explain why sixteen bytes can identify a likely format but cannot establish that the complete file is valid.

## Station 2: printable strings

Install [Extract strings from binary bytes](/recipes/binary-files/extract-binary-strings/). Change the minimum length and compare the amount of noise.

## Station 3: compression layers

Compare:

- [Decode Base64 and Gunzip](/recipes/binary-files/gunzip-base64/)
- [Unpack a Gzip hexdump](/recipes/unpack-gzip-hexdump/)

Both end with Gunzip, but their outer representations require different first operations.

## Station 4: static disassembly

Install [Disassemble benign x86 bytes](/recipes/binary-files/disassemble-x86/). The sample is a tiny synthetic function that returns the value 42. Change the selected bitness and note how the interpretation can change.

## Assignment

Given an unfamiliar hex listing, write a triage plan before adding operations. Your plan must include signature detection, strings, entropy or compression hypotheses, and a statement that no bytes will be executed.

> **Keep analysis static**
>
> Do not run unknown scripts, binaries, macros, or shellcode. Serialize helps transform and inspect data; it is not a malware sandbox.

Source: https://help.serialize.dev/courses/binary-and-file-triage/index.mdx