Open an evidence file to begin.
Choose a file, drop one here, or open the sample to try things out. Nothing is uploaded: Hexes reads the file in your browser, read-only, and hashes it as soon as it loads.
Disk images work too. Hexes only reads the parts you look at, so a multi-gigabyte file opens instantly.
Rules run in this browser with YARA-X. The engine (about 2 MB) downloads once from jsDelivr and is checked against a pinned hash. Your file and rules stay here.
Finds file signatures anywhere in the file: executables, archives, documents, images, registry hives, event logs and more. Short signatures only count when the structure around them checks out.
Click a hit to jump to it. An embedded file usually runs up to the next signature, so you can select or carve that far.
Bookmark the selection, or the byte under the cursor. Timestamps are spotted and decoded. Bookmarks stay in this browser and come back when you reopen the same file (matched by SHA-256).
F2 jumps to the next bookmark, Shift+F2 to the previous one.
Decodes the current selection. Select bytes in the grid first.