PNG Image
| Format | PNG Image |
|---|---|
| Short name | PNG |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (ImageParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Lossless image format used for screenshots, app icons, and UI graphics. Unlike JPEG, PNG uses lossless compression — pixel data is preserved exactly. Metadata is stored in typed chunks: tEXt/zTXt for plain-text comments, iTXt for Unicode and XMP data, tIME for last-modification timestamp, eXIf for EXIF data (registered extension, part of the PNG Third Edition). The IEND chunk marks the end of the file — any data appended after IEND is forensically significant and may indicate steganography or embedded payloads. LSB steganography in IDAT pixel data is common and detectable. Screenshots typically lack camera EXIF metadata, which can help distinguish them from camera photos. The iDOT chunk is Apple-specific and undocumented. An embedded C2PA (Content Credentials) manifest, carried in the ancillary 'caBX' chunk, can record generating/editing software, an IPTC Digital Source Type (a direct AI-generation/-editing signal), and a signed claim identity — PNG is a common output format for AI image generators.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 89 50 4E 47 0D 0A 1A 0A | .PNG.... | PNG signature |
Known extensions
.png
References
- PNG format spec (W3C, Third Edition) https://www.w3.org/TR/PNG/
- PNG text chunk extractor (dCode) https://www.dcode.fr/png-chunks
- pngcheck — PNG integrity and chunk inspector http://www.libpng.org/pub/png/apps/pngcheck.html
- Steganography detection in PNG (IEND, LSB, chunks) https://klaroskope.com/learn/steganography-detection-techniques
- C2PA Technical Specification (Content Credentials) https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html
Cite this entry
Crush Format Reference, “PNG Image”. https://kalink0.github.io/crush-forensics/formats/png/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction