File Identifier & Recovery

Workforge File Identifier & Recovery inspects the first few kilobytes of any file, matches those bytes against a curated table of known file-format signatures, and tells you exactly what the file actually is - regardless of what its filename claims. If the extension is wrong, the tool offers to rename it correctly. Everything happens in your browser: nothing is uploaded, nothing is stored, nothing is logged. The most common use case is recovering photos and videos that were renamed to .dll by ransomware, a broken sync tool, or a copy-paste mishap. If the file itself is intact, a magic-byte lookup will reveal what it really is and let you download it with the right extension.

The tool covers the file formats people actually deal with day-to-day. Images: JPEG, PNG, GIF, WebP, HEIC (including iPhone Live Photos), BMP, and TIFF. Video: MP4, MOV, MKV, WebM, AVI, and M4V. Audio: MP3, WAV, FLAC, and OGG. Documents: PDF. Archives: ZIP, 7z, RAR, and GZIP. Real Windows executables (DLL, EXE) are detected via the MZ header and blocked from rename so you never touch a legitimate system file by accident.

The tool also computes Shannon entropy over the first few kilobytes of each file. When entropy is very high (approaching maximum) and no signature matches, that combination strongly suggests the file has been encrypted or heavily compressed with no format header preserved. In practice this is the fingerprint of ransomware. When that pattern shows up, the tool blocks rename, surfaces a warning panel, and links directly to nomoreransom.org (free known-decryptor lookup) and cisa.gov/stopransomware (US federal incident response guidance). Renaming an encrypted file does not recover its contents - only decryption does. The tool refuses to pretend otherwise.

Common uses beyond ransomware recovery: quickly checking the real type of a file from an unfamiliar source, batch-fixing extensions on files exported from a broken tool, verifying a file matches the extension you were told it would, and inspecting the first 16 bytes of any file for forensics or debugging. Bulk workflow: drop 100 files at once, then either download each renamed file individually or grab a single ZIP of every renameable file. All of it, still, in your browser.

Every file on your computer has two things: an extension (like .jpg or .pdf) and its actual contents. The extension is metadata - a label someone attached to the file. The contents are the truth. When those two things don't agree, the extension wins by default: Windows opens the file with whatever app matches the extension, and if that app can't read the real contents, you get an error, a blank screen, or worse.

A file identifier reads the actual contents. It looks at the first few bytes -- the magic bytes, or file signature -- and matches them against a table of known formats. Every real file format writes a distinctive header at the start of the file: PNG starts with the bytes 89 50 4E 47, PDF starts with %PDF, a real Windows DLL starts with 4D 5A. Those headers cannot be changed without breaking the file. So even if someone renames photo.jpg to invoice.pdf, the magic bytes still say this is a JPEG.

This matters in three concrete situations. First, safety: a file you downloaded with a .jpg extension may actually be a Windows executable in disguise -- a common malware delivery pattern. A file identifier catches this before you double-click. Second, recovery: files that came off a broken drive, a crashed sync, or a ransomware attack often have the wrong extension or none at all. Reading the real contents tells you what the file actually is so you can rename it correctly and open it again. Third, verification: when you get a file from an unfamiliar source and the sender says it's a PDF, a file identifier confirms whether that's true.

Extensions are a convention. Magic bytes are a fact.

Downloaded a file from an unfamiliar source. Especially attachments that arrived over email, chat, or a random link -- checking the real type before you open it takes ten seconds and eliminates the most common malware trap.

Files recovered from a broken drive. Photo recovery tools often output thousands of files named 0001, 0002, 0003 with no extension at all. Drop the whole folder into the identifier and it will tell you which are JPEGs, which are MP4 videos, which are documents, and give you the correct extensions in one shot.

Photos or videos renamed by ransomware or a broken sync tool. If a photo library got renamed to .dll, .locked, or something similar, the underlying image data may still be intact -- the extension just needs to be corrected. The identifier detects the real format, blocks real DLLs from being touched, and warns you if the file appears to be encrypted rather than merely renamed.

Files that won't open with the expected program. Windows guesses which app to launch based on extension. When you get we can't open this file, the extension is often lying. The identifier tells you what the file actually is so you can open it with the right tool.

Batch verification before sharing. Before sending a folder of files to a client, colleague, or friend, run the whole batch through the identifier to confirm every file is what its name claims. Especially useful for anyone in operations, forensics, or IT support.

Curiosity. Some file arrived with no extension and no context and you just want to know what it is.

Every other free file identifier online asks you to upload the file. That means every file you check -- including files you're checking because you're not sure whether they're safe -- passes through someone else's server, gets stored somewhere for some amount of time, and is subject to whatever privacy policy, retention policy, and breach risk that server has.

Workforge File Identifier & Recovery runs entirely in your browser. When you drop a file into the tool, JavaScript in the page reads the first few kilobytes locally and matches them against a signature table also loaded in the page. No network request touches the file. No server sees the contents. Nothing is logged. Close the tab and the file is gone from the tool's memory.

That matters most for exactly the files you're most likely to want identified: sensitive documents, recovered personal photos, potentially malicious downloads, and anything else you wouldn't hand over to a random SaaS company. Uploading those files defeats the purpose of checking them.

It's also faster. Everything happens locally, so there's no upload wait, no rate limits, and no server queue. Drop a hundred files at once and get results in seconds.

Free, ad-free, no signup, no tracking, no upload. That's the point.