Read the carving address map#

Scan the whole file as one heatmap strip with an entropy curve beneath it, then drag-select to zoom into a sub-range.

The Address map at the top of the Carving tab is a horizontal timeline of the whole file's bytes. It is the fastest way to see where the suspicious regions are. It also shows how big they are relative to the file.

Read the map rows#

The map reads from left to right.

  • The top row is a hex offset axis, marked at regular intervals.
  • The middle row is the heatmap. Each column represents a byte range. The colour shows the strongest signal in that range.
  • The bottom row is the entropy curve. It uses the same horizontal scale as the heatmap. Dashed threshold lines mark the high · 6.5 and packed · 7.5 buckets.

A zoomed sub-range of the address map, showing the entropy curve dropping past the packed and high threshold lines, with the legend and Reset control below

Legend colours#

The legend below the map names every colour in the heatmap. Each colour carries a count of the regions or matches that contributed.

  • Low: white or near-white. Low entropy.
  • High: amber. High-entropy regions.
  • Packed: the packed entropy bucket.
  • FOUND: embedded file signatures. The legend splits these into Embedded exec, Archive, PDF, Image, and Polyglot. Each has its own colour. The map uses a colour only when the matching pass produced a hit.

Stats bar#

A four-card stats bar sits directly under the legend.

  • Entropy distribution shows the M / MIN / MAX entropy across all regions, plus a count of the low, normal, high, and packed regions.
  • Polyglot shows the number of formats in conflict and the number of polyglot matches.
  • Embedded files shows the count of embedded segments, grouped by detected kind (PE/ELF, Archive, and so on).
  • Outliers shows the count of regions flagged as high-entropy outliers.

Zoom into a sub-range#

To zoom into a sub-range, drag-select on the heatmap. The window in the card head updates and the heatmap resamples to the new range. When you are zoomed in, a Reset control appears at the right of the legend row. Click it to return to the full file.