Byte signature matching
The detector reads binary values from the file and compares relevant starting bytes with recognized format signatures. For example, PNG files have a defined eight-byte signature, while several ZIP-based formats begin with the same ZIP marker. Matching is performed on byte values, not on how those bytes would appear if decoded as ordinary text.