Scan for Embedded Files

Category: Forensics

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: ArrayBuffer → string

Background: https://wikipedia.org/wiki/List_of_file_signatures

What it does

Scans the data for potential embedded files by looking for magic bytes at all offsets. This operation is prone to false positives. WARNING: Files over about 100KB in size will take a VERY long time to process.

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Arguments and options

Arguments are positional. Keep their order when using bake() or Pipeline.then().

Index	Name	UI type	PyChef default	Accepted values / format
`0`	Argument 0	`boolean`	`'cat === "Miscellaneous" ? false : true'`	`True` or `False`

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = b"example"
args = ['cat === "Miscellaneous" ? false : true']
result = bake(input_value, [{"op": 'Scan for Embedded Files', "args": args}])
print(result)

Pipeline example

from pychef import Pipeline

args = ['cat === "Miscellaneous" ? false : true']
transform = Pipeline().then('Scan for Embedded Files', *args)
result = transform(b"example")

Direct call

pychef.ops.run_operation runs any registered operation as a plain function, under the active ExecutionPolicy (safe defaults, no network):

from pychef.ops import run_operation

args = ['cat === "Miscellaneous" ? false : true']
result = run_operation('Scan for Embedded Files', b"example", args=args)

Common operations also have typed helpers in Direct operations.

Low-level operation module

Warning

The module below is an internal implementation detail. It applies no execution policy, resource limits, or error sanitization; prefer bake(), Pipeline, or pychef.ops for application code.

The registered entry point lives in pychef.operations.by_operation.scan_for_embedded_files. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.scan_for_embedded_files import run

result = run(b"example", tuple(['cat === "Miscellaneous" ? false : true']))

pychef.operations.by_operation.scan_for_embedded_files.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes