> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/file-analysis/embedded-data-extraction/trick-0575.md).

# Extract Embedded Data From Image

***

Use `exiftool` to check for anomalies within the file structure, specifically looking for data appended after the expected end-of-file marker. ExifTool is a program that can be used to read, write and edit meta information in a wide variety of files and can be used to extract hidden data from files.

```bash
exiftool image.png
```

Pay attention to output like `Warning: [minor] Trailer data after PNG IEND chunk` (or similar warnings for other file types), which confirms the presence of appended data.

To automatically extract this hidden data, use `binwalk` with the extract option. Binwalk is a firmware analysis tool that searches a given binary image for embedded file systems and executable code. The `-e` option will automatically extract known file types.

```bash
binwalk -e image.png
```

This command analyzes the file for embedded data and extracts it into a separate directory structure in the current location. Binwalk will create a directory named `_image.png.extracted` in the current working directory and extract the files into it.