Embedded within files is a magic number or a file signature. These magic numbers help identify the file type and are located at the start of the files. This helps us to identify the file type or format or what software program to use to open a file. Please remember that just because a file has an extension does not mean it is the file.
Wikipedia contains a great listing of magic numbers.
To view a file's magic number, we need to open it in a hex editor. If you are going to use Linux, I suggest using Bless. In MacOS, I suggest using Hex Fiend, and in Windows, use HxD.
Magic numbers are helpful in forensics investigations because they are a reliable way to determine a file type—even if metadata is removed or the file has been manipulated. Keep in mind that some files might have variations or additional headers, and some malicious files might try to hide their magic number to avoid detection. Overall, magic numbers are helpful in file identification.
In this demo, I use the Bless hexeditor to open several files and locate the magic number to identify the exact filetype.
Linux has a great utility called 'file' that we can use to identify its type.