🔍 Metadata & Hex Editors Lab

Every file is secretly just bytes. A hex editor shows you those bytes directly, including the metadata a file carries about itself. In this lab you'll read a sample dump, then use a real hex reader on one of your own files.

What is hexadecimal, really?

A hex editor writes bytes in hexadecimal instead of binary because it's a lot easier to read. Here's the actual trick: one hex digit always stands for exactly 4 bits - never more, never less. Four bits gives you 16 possible patterns (0000 through 1111), but we only have 10 decimal digits (0-9) to work with - so hex borrows the letters a through f to cover the last six patterns:

0000 = 0 0100 = 4 1000 = 8 1100 = c 0001 = 1 0101 = 5 1001 = 9 1101 = d 0010 = 2 0110 = 6 1010 = a 1110 = e 0011 = 3 0111 = 7 1011 = b 1111 = f

That's it - hex isn't a new number system to learn from scratch, it's just a shorthand for writing 4 bits at a time without a wall of 0s and 1s. A hex editor is really just showing you binary, 4 bits per digit, two digits per byte.

Practice: bits ↔ hex

Convert each one using the table above. Hex letters can be typed upper or lowercase.

0 of 8 correct

What's a hex editor?

A hex editor shows a file's raw bytes, written as hexadecimal, alongside an ASCII column so any readable text hiding in the file jumps right out. Nearly every file format starts with a magic number - a fixed byte sequence identifying what kind of file it is. Every JPEG on the planet starts the same way:

000000 FF D8 FF E0 00 10 4A 46 49 46 ....JFIF

Where metadata actually hides

Metadata is data about data - not the picture, the song, or the document itself, but facts describing it: when it was made, where, by what device. Metadata usually lives in a header near the start of the file, before the real content begins. JPEG often carries an EXIF block (camera make/model, timestamp, sometimes GPS) as plain readable ASCII sitting right inside the binary. PNG uses labeled chunks like tEXt. MP3 uses ID3 tags.

Spot it - sample dump

Here's an excerpt from partway through a real-looking JPEG's EXIF header. The camera's manufacturer is hiding in plain sight in the ASCII column.

000018 00 1A 00 03 00 00 00 01 00 4E 00 00 000024 4E 49 4B 4F 4E 00 44 33 32 30 30 00 NIKON.D3200. 000030 32 30 32 36 3A 30 39 3A 32 36 00 00 2026:09:26..

What camera manufacturer can you read directly in the ASCII column?

Full hex reader - three real files to examine

These three files sit in the src/ folder right next to this lab. Load each one into the hex reader and look for its metadata - the data about the data, not the picture, song, or document content itself.

Open file in new tab \u2197
Open file in new tab \u2197
Open file in new tab \u2197

Bonus (optional) - your own file

Not required for your certificate. Pick any file from your own device to see its hex dump the same way - nothing gets uploaded anywhere, this reads the first 8 KB locally in your browser.

Requirements

Questions

Example: a photo taken on a phone might carry metadata like the camera model, the exact date and time it was taken, the GPS location, and the camera settings used - all separate from the actual image itself.

Done with the hex reader and the questions? Check your work to see what's still missing and generate your certificate. You can check again anytime - only your best grade is kept.

Check your work above to unlock your certificate.
🏆
Certificate of Completion

This certifies that

Student