> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/file-analysis/embedded-data-extraction/trick-0452.md).

# Extract Embedded File from Polyglot

***

Use tools like `binwalk` or `foremost` to scan polyglot files for embedded data based on file signatures. These tools can automatically detect and extract known file types hidden within another file.

```bash
binwalk -e <filename>
```

`binwalk` can automatically extract known file types found during the scan. For more comprehensive analysis, you can use the `-M` option for recursive scanning, which will scan files that were extracted from the original file. You can also use `-DD` to extract specific file types using the `dd` utility or `-R` to scan for a specified regex pattern.

```bash
binwalk -Me <filename> # Recursive extraction
binwalk -DD 'zip' <filename> # Extract only zip files
binwalk -R 'PK\x03\x04' <filename> # Scan for ZIP header regex
```

or

```bash
foremost -i <filename>
```

`foremost` is another tool for file carving. You can specify the input file with `-i` and direct the output to a specific directory using the `-o` option. You can also limit the search to specific file types using the `-t` option, providing a comma-separated list of types. A configuration file can be used with `-c` to define custom file headers and footers.

```bash
foremost -i <filename> -o output_directory # Specify output directory
foremost -i <filename> -t jpg,pdf,zip # Specify file types
foremost -i forensic.img -t jpg,gif,bmp,pdf,zip,rar,doc,docx,xls,xlsx -o output # Example with multiple types
```

Alternatively, manually inspect the file using a hex editor, searching for file headers or footers of common formats (e.g., `PK\x03\x04` for a ZIP file). Hex editors typically include a "Find" utility (often accessible via Ctrl+F) which allows searching for specific byte sequences or text strings, making it easier to locate these signatures within the file's raw data. This is particularly useful for formats like ZIP files where the header `PK\x03\x04` marks the start of an entry. Once identified, manually extract the data block.