Understanding Endianness
Endianness refers to the sequential order in which bytes are arranged into larger numerical values when stored in memory or on disk.
Big-Endian vs. Little-Endian
Consider the 32-bit hexadecimal number 0x12345678.
Big-Endian (Network Byte Order)
The most significant byte (the "big end") is stored at the lowest memory address.
Storage: 12 34 56 78
Used in network protocols (TCP/IP) and formats like JPEG and PNG.
Little-Endian
The least significant byte (the "little end") is stored at the lowest memory address.
Storage: 78 56 34 12
Used natively by x86 and x64 processors, and therefore used in Windows PE files and many binary structures.
Forensic Impact
When analyzing a file in a hex viewer, you must know the endianness of the file format to correctly interpret multi-byte values (like offsets, sizes, or timestamps). Reading a Little-Endian 32-bit integer as Big-Endian will result in a wildly incorrect value.
Common Mistakes
| Mistake | Consequence | Better Approach |
|---|---|---|
| FileReader.readAsArrayBuffer | Browser Crash (OOM) | Use File.slice for chunks |
| Rendering full DOM | Browser freeze | Virtualized list rendering |
FAQ
What is the max file size?
By using slicing and streams, we can handle files limited only by your OS filesystem (e.g., 2TB on NTFS), not your RAM.