How to Check an Unknown File Before Opening It (Hash, Real Format, Virus Signal)

How to Check an Unknown File Before Opening It (Hash, Real Format, Virus Signal)

A file received by email, downloaded from a forum or shared through a link can look ordinary while still deserving a second look. A familiar name and an innocent-looking extension are not enough to tell you what the bytes contain. If the sender is unfamiliar or the source is only partly trusted, checking the file online before opening it can provide useful technical context. FileInspection is designed as a first inspection step: it produces one JSON report with a hash, the detected MIME type, a preliminary antivirus signal and other clues that help you decide what to do next.

Start with the real file type

The extension is only a label supplied by the filename. A file called invoice.pdf may not contain a real PDF, and a renamed executable can be made to look like a document. FileInspection detects the MIME type from the file itself rather than relying only on the extension declared by the sender. That distinction is useful when an attachment has been renamed, when a download has an unexpected format or when a shared archive deserves inspection before extraction.

The report also includes the original filename and size. Together, these fields give you a quick way to compare what you expected to receive with what was actually uploaded. The service accepts one non-empty file per inspection, up to 50 MB, with no extension allowlist. That makes the check useful for documents, images, archives and other files, while the size limit keeps the first review bounded.

Use the SHA-256 hash as an identity clue

FileInspection calculates a SHA-256 hash, sometimes called a checksum or fingerprint. The hash is not a verdict about safety. It is a compact identifier for the exact bytes that were inspected. If an official download page publishes a SHA-256 value, you can compare the two values to see whether the files match. You can also use the hash in your own notes or inventory to recognize the same file later without depending on a filename that could easily be changed.

A matching hash tells you that the bytes are the same as the reference you checked; it does not prove that the reference itself is trustworthy. A different hash tells you that the files differ, but it does not explain why. Treat the comparison as evidence to investigate, not as a replacement for checking the source and the context of the download.

Read the antivirus result carefully

The report includes a antivirus engine signal with one of three statuses: clean, infected or error. This is a preliminary triage signal, never an antivirus guarantee. A clean result means that this scan did not report a detection; it does not certify the file as safe, and it cannot replace a complete antivirus product and the security controls on your own device. An infected signal is a reason to stop and investigate. An error means that the signal was unavailable or could not be completed, so you should not interpret it as clean.

The report also provides a detection rule result: clean, matched or not_run. The supplied detection rules are a minimal starter set, not an exhaustive detection database. A clean result does not certify the file, and a match should be treated as a strong reason for caution rather than as a complete malware classification. Keep both limitations in mind when discussing the result with someone else.

Look for useful context before opening

For images and PDFs, the report can include an OCR preview limited to 500 characters. That can help you see whether a supposed invoice, scan or screenshot contains the expected text before opening it in a desktop application. For media files, technical information can include the codec, resolution, duration and bitrate, obtained through FFprobe. ExifTool may provide filtered EXIF metadata when it applies. These fields do not replace a full content review, but they can reveal a mismatch between the story told by the filename and the file’s technical structure.

A cautious workflow

Upload the file to FileInspection, wait for the asynchronous process to finish and download the authenticated JSON result. Compare the SHA-256 value with an official source when one exists. Check the MIME type, size and relevant metadata, then interpret the the antivirus and detection-rule checks statuses as triage signals. If anything is unexpected, do not open, execute, extract or forward the file; contact the sender through a trusted channel and use the security tools on your own computer.

Each successful inspection costs 12 tokens. A validation failure, such as an empty file or a file over 50 MB, is not billed. The service is a practical way to check an unknown file online before opening it, but the final decision still belongs to you and your local security process.