binwalk

https://github.com/ReFirmLabs/binwalk

foremost / scalpel

https://github.com/korczis/foremost
https://github.com/sleuthkit/scalpel

# identify file type
file suspicious.img

# check entropy (packed / encrypted regions)
binwalk -E suspicious.img

# initial scan (structure + offsets)
binwalk suspicious.img

# recursive extraction (main workflow)
binwalk -Me suspicious.img

# list extracted structure
ls -lah _suspicious.img.extracted/

# find potential filesystems / rootfs
find . -type f | grep -Ei "squashfs|ubifs|cramfs|ext|rootfs|uimage"

# locate root directories
find . -type d | grep -Ei "rootfs|squashfs-root|ubifs|etc|www|html"

# if squashfs found
unsquashfs <filesystem>

# if ext filesystem found
sudo mount -o loop,ro <filesystem.img> /mnt

# if UBI/UBIFS found
ubireader_extract_files <ubi.img>

# extract raw data carving (fallback)
foremost -i suspicious.img -o carved/
scalpel suspicious.img -o carved_scalpel/

# inspect partitions (if disk image)
fdisk -l suspicious.img

# mount with offset (if partitioned image)
sudo mount -o loop,ro,offset=<OFFSET> suspicious.img /mnt

# quick strings for creds / execution
strings suspicious.img | grep -Ei "password|admin|root|telnet|ssh|http"

# hunt for URLs / C2
strings suspicious.img | grep -Ei "http|ftp|dns"

# hash extracted payloads
sha256sum extracted_file

# inspect magic bytes
xxd -l 16 extracted_file

# expected headers:
# MBR = 55 AA
# ELF = 7F 45 4C 46
# SquashFS = 68 73 71 73
# UBI = 55 42 49 23
# ZIP = 50 4B

# hunt for binaries
find . -type f -executable

# identify binaries
file <binary>

# decompress everything
for f in *.xz; do unxz "$f"; done  
for f in *.zip; do unzip "$f" -d "${f}_out"; done

Hunting Matrix