The first sixteen bytes are the only honest part of a file
A filename extension is a convention, not a property. Nothing enforces it. It survives being renamed, being copied, being emailed and being wrong, and the operating system will keep showing you a photo icon for a file that is not a photo. Every program that actually has to read the file ignores the name and looks at the bytes, which is why an upload can fail on a file your computer displays perfectly.
Formats identify themselves in their first few bytes with a signature, usually called a magic number. A JPEG starts with FF D8 FF. A PNG starts with the byte 0x89 followed by the letters PNG and a short sequence chosen to detect damage in transfer. A PDF starts with the literal text %PDF-, and a ZIP with PK, the initials of Phil Katz, who wrote the original format in 1989. These are the first thing a decoder checks, and they are what this tool reads.
Some families need a second look. The ISO base media container is used by MP4 video, by QuickTime, by AVIF images and by the HEIC photos an iPhone takes, and all of them begin with a length field followed by the letters ftyp. What separates them is the brand code immediately after: avif for an AVIF image, heic or mif1 for a HEIC photo, isom or mp42 for video. Reading only the ftyp box is how an inspector gets talked into calling a photograph a video. RIFF has the same shape, wrapping WebP, WAV and AVI behind identical opening bytes, with the payload type four bytes further in.
Once the format is known, each one has its own place where information collects. JPEG and HEIC carry EXIF, a block written by the camera that can hold the GPS coordinates of the shutter press, the camera body and lens, and a name in the artist or copyright field. PDF has an information dictionary with the author, the producing software and two timestamps, and it survives edits to the text because nothing about editing text touches it. Office documents are ZIP archives, and a ZIP ends with a central directory that lists every part inside it, so the contents can be enumerated without decompressing a single byte or knowing any password. That listing is enough to see whether a document carries a vbaProject.bin, which is where a macro lives.
All of this is a read, never a write. The bytes are examined in the tab and the file is left exactly as it was, which also means the tool can be pointed at anything without risk. If something turns up that should not travel with the file, the fix belongs to a different tool: strip the metadata, or convert the image to a format that never carried it in the first place.