Recently my Drupal site on a Linux server has been targeted by session hijacking attacks. I guess the attacks were originated from images containing malicious code which where uploaded to the web root because I have found some of the crafted images by looking at uploaded files. So I am wondering how best to find all those images?
If you know what you're looking for, then you simply examine the data within the file to see if it matches the pattern you're looking for. How you do that depends on what sort of pattern it is; you could view the files in a text editor (for text-based patterns) a hex-viewer (for binary patterns) or you could write (or otherwise acquire) a program that will tease these patterns out of the files and present you with a report.
On the other hand, if you don't know what you're looking for, then you're obviously not going to find it.