Forensics Challenge 2 - Magic Bytes

Accuracy: 100%

Prompt

Cyber Command: This file appears to be changed in some way. Can you recover the original?

Answers

What is the original file type? (25 pts)
PNG

What is the flag? (75 pts)
SKY-DSFG-5792

Steps I Took

Downloaded and tried to open the file — it failed, confirming it was corrupted/modified.

Loaded the file into CyberChef and used the Strings operation. Spotted both JFIF (JPEG) and IHDR (PNG) markers. Since IHDR is the PNG header chunk, the original file type was PNG.

Looked up the correct PNG file signature (89 50 4E 47 0D 0A 1A 0A) and opened the file in Hexedit. Replaced the first 4 bytes with the PNG magic bytes, then replaced the remaining JFIF header data with 00 00 00 0D.

Opened the fixed file — it displayed correctly and showed the flag.