Which evidence path comes first?
Understand representation and bytes before choosing entropy, checksum, or cryptographic digest evidence.
Elysia Tools
Navigation
Workflow Playbook
Inspect bytes and signatures, identify file types, measure entropy, and verify hashes or checksums in one safe forensic workflow.
Hubs
Inspect bytes and signatures, identify file types, measure entropy, and verify hashes or checksums in one safe forensic workflow.
Use this guide to turn the stated scope into a reviewable result. Keep the source, intermediate outputs, and decisions together so the next person can understand what was checked and why.
Use a non-sensitive sample or approved evidence copy; never upload private keys or confidential files.
Record expected encoding, file name, MIME type, and trusted digest or checksum.
Decision: Which evidence path comes first?. Understand representation and bytes before choosing entropy, checksum, or cryptographic digest evidence.
Decision: Does metadata agree with bytes?. Compare extension and MIME with signature detection; record mismatches without treating them as a safety verdict.
Convert the sample with the matching radix or encoding tool and retain exact input and output. Use base-n-radix-converter, base32-converter, base58-converter, base64-converter, text-to-binary, hex-to-string.
Review offsets, bytes, and printable regions in a read-only hex view, then identify the magic number and file type. Use hex-editor, magic-number-detector, file-type-detect, mime-type-detector.
Measure entropy and calculate CRC32 for an accidental-corruption check, interpreting both with file context. Use entropy-calculator, crc32-checksum.
Choose the required algorithm, hash the file or text, and compare the result with the trusted digest. Use hash-algorithm-comparator, file-hash-verifier, text-hash-generator.
Workflow playbook
Convert the sample with the matching radix or encoding tool and retain exact input and output.
Review offsets, bytes, and printable regions in a read-only hex view, then identify the magic number and file type.
Measure entropy and calculate CRC32 for an accidental-corruption check, interpreting both with file context.
Choose the required algorithm, hash the file or text, and compare the result with the trusted digest.
Understand representation and bytes before choosing entropy, checksum, or cryptographic digest evidence.
Compare extension and MIME with signature detection; record mismatches without treating them as a safety verdict.