%%WwW.57VVV_CoM%%>嫩肉禁护★WwW.57VVV_CoM〓战士猛击宏这里〓WwW.57VVV_CoM
点击联系发帖人
时间：2012-03-26 19:16
File Signatures
FILE SIGNATURES TABLE
23 July 2016
This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I had found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list in 2002. See also Wikipedia's . Comments, additions, and queries can be sent to Gary Kessler at .
This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:
, The Programmer's File and Data Resource
Some other useful information:
page contains a custom signature file based upon this list, for use with FTK, Scalpel, Simple Carver, Simple Carver Lite, and TrID.
Web site searches a database based upon file extension or file signature.
Tim Coakley's
site, with Filesig Manager and Simple Carver. Also, see Tim's
page, "a repository of information used to identify specific SQLite databases and properties for research purposes."
Marco Pontello's
utility designed to identify file types from their binary signatures.
The National Archives'
site provides on-line information about data file formats and their supporting software products, as well as their multi-platform
Additional details on graphics file formats can be found at
Additional details on audio and video file formats can be found at the
Another collection of many types of file format specifications can be found at Alex Kirk's .
Shaul Zevin's
page presents an ontology on which his
tool is built, a Web-based tool to classify a file by signature.
If you are using a Linux/Mac OS X/Unix system, you can use the
command to determine the file type based upon the file signature, per the system's magic file.
And, one last and final item — if you are searching for network traffic in raw binary files (e.g., RAM or unallocated space), see .
Hex Signature
& & & & & &ASCII Signature
File Extension
& & & & & &File Description
Truevision Targa Graphic file
54 52 55 45 56 49 53 49 & TRUEVISI
4F 4E 2D 58 46 49 4C 45 & ON-XFILE
2E 00 & & & & & & & & & & ..
IBM Storyboard bitmap file
Apple QuickTime movie file
Windows Program Information File
Mac Stuffit Self-Extracting Archive
IRIS OCR data file
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
Compucon/Singer embroidery design file
[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
[11 byte offset]
Palmpilot Database/Document File
[512 (0x200) byte offset]
00 00 00 00 00 00 00 00
[512 (0x200) byte offset]
Revit Project File subheader
00 00 00 00 14 00 00 00
Windows Disk Image file
[8 byte offset]
00 00 00 00 62 31 05 00
09 00 00 00 00 20 00 00
00 09 00 00 00 00 00 00
[8 byte offset]
Bitcoin Core wallet.dat file
00 00 00 0C 6A 50 20 20
Various JPEG-2000 image file formats
00 00 00 14 66 74 79 70
3GG, 3GP, 3G2
3rd Generation Partnership Project 3GPP multimedia files
00 00 00 14 66 74 79 70
69 73 6F 6D
ISO Base Media file (MPEG-4) v1
00 00 00 14 66 74 79 70
71 74 20 20
QuickTime movie file
00 00 00 18 66 74 79 70
33 67 70 35
MPEG-4 video files
00 00 00 18 66 74 79 70
6D 70 34 32
MPEG-4 video/QuickTime file
00 00 00 1C 66 74 79 70
4D 53 4E 56 01 29 00 46
4D 53 4E 56 6D 70 34 32
MPEG-4 video file
00 00 00 20 66 74 79 70
3GG, 3GP, 3G2
3rd Generation Partnership Project 3GPP2 multimedia files
00 00 00 20 66 74 79 70
4D 34 41 20
Apple Lossless Audio Codec file
00 00 01 00
Windows icon file
Windows NT/2000/XP printer spool file
00 00 01 Bx
MPEG video file
00 00 01 B7 (...·)
00 00 01 BA
....º
DVD Video Movie File (video/dvd, video/mpeg) or DVD MPEG2
00 00 01 B9 (...¹)
00 00 02 00
Windows cursor file
QuattroPro for Windows Spreadsheet file
00 00 02 00 06 04 06 00
08 00 00 00 00 00
Lotus 1-2-3 spreadsheet (v1) file
00 00 03 F3
executable file
00 00 1A 00 00 10 04 00
00 00 00 00
Lotus 1-2-3 spreadsheet (v3) file
00 00 1A 00 02 10 04 00
00 00 00 00
Lotus 1-2-3 spreadsheet (v4, v5) file
00 00 1A 00 05 10 04
Lotus 1-2-3 spreadsheet (v9) file
00 00 49 49 58 50 52 or
00 00 4D 4D 58 50 52
Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
th 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.
00 00 FE FF
..þÿ
Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the .)
[6 byte offset]
00 00 FF FF FF FF
[6 byte offset]
..ÿÿÿÿ
Windows Help file
00 01 00 00 00
TrueType font file
00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
Microsoft Money file
00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
Microsoft Access 2007 file
00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
Microsoft Access file
00 01 00 08 00 01 00 01
Ventura Publisher/GEM VDI Image Format Bitmap file
OpenFlight 3D file
00 01 42 41
Palm Address Book Archive file
00 01 42 44
Palm DateBook Archive file
00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00
...Ò....
Netscape Navigator (v4) database file
00 0D BB A0
..» 
Mbox table of contents file. (NOTE: The next four bytes
appear to be the number of e-mails in the associated mbox file.)
FLIC Animation file
00 14 00 00 01 02 xx xx
BIOS details in RAM images
00 1E 84 90 00 00 00 00
..„.....
Netscape Communicator (v4) mail folder
00 20 AF 30
Wii images container
00 5C 41 B1 FF
.\A±ÿ
Mujahideen Secrets 2 encrypted file
[512 (0x200) byte offset]
00 6E 1E F0
[512 (0x200) byte offset]
PowerPoint presentation subheader (MS Office)
Adobe Flash shared object file (e.g., Flash cookies)
00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01
.ÿÿÿÿÿÿÿ
ÿÿÿ.....
Alcohol 120% CD image
01 00 00 00
Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)
01 00 00 00 01
Unknown type picture file
01 00 09 00 00 03
Windows Metadata file (Win 3.x format)
01 00 02 00
Webex Advanced Recording Format files.
01 00 39 30
Firebird and Interbase database files, respectively. See
for more information.
01 01 47 19 A4 00 00 00
00 00 00 00
..G.#xA4...
secure e-mail Message Base Index file
01 0F 00 00
Microsoft SQL Server 2000 database
Novell LANalyzer capture file
01 DA 01 01 00 03
.Ú....
Silicon Graphics RGB Bitmap
01 FF 02 04 03 02
.ÿ....
Micrografx vector graphic file
02 64 73 73
Digital Speech Standard (Olympus, Grundig, & Phillips)
MapInfo Native Data Format
dBASE III file
03 00 00 00
Quicken price history file
03 00 00 00 41 50 50 52
Approach index file
dBASE IV data file
04 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00 or
05 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00
file. NOTE: Bytes 12-13
indicate the size of each INFO2 the most common
value is 0x20-03 (0x0320 = 800 bytes).
06 06 ED F5 D8 1D 46 E5
BD 31 EF E7 FE 74 B7 1D
..íõØ.Få
½1ïçþt·.
Adobe InDesign document.
A common signature and file extension for many drawing
07 53 4B 46
SkinCrafter skin file
07 64 74 32 64 64 74 64
DesignTools 2D Design file
dBASE IV or dBFast configuration file
Possibly, maybe, might be a fragment of an Ethernet frame carrying
an IPv4 packet. See .
[512 (0x200) byte offset]
09 08 10 00 00 06 05 00
[512 (0x200) byte offset]
Excel spreadsheet subheader (MS Office)
0A nn 01 01
ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)
0A 16 6F 72 67 2E 62 69
74 63 6F 69 6E 2E 70 72
MultiBit Bitcoin wallet file
Monochrome Picture TIFF bitmap file (unconfirmed)
0D 44 4F 43
DeskMate Document file
0E 4E 65 72 6F 49 53 4F
Nero CD Compilation
0E 57 4B 53
DeskMate Worksheet
[512 (0x200) byte offset]
0F 00 E8 03
[512 (0x200) byte offset]
PowerPoint presentation subheader (MS Office)
10 00 00 00
Easy CD Creator 5 Layout file
Lotus Notes database template
1A 00 00 04 00 00
Lotus Notes database
LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)
Compressed archive file
(often associated with Quake Engine games)
1A 35 01 00
GN Nettest WinPharoah capture file
1A 45 DF A3
.Eߣ
WebM video file
1A 45 DF A3 93 42 82 88
6D 61 74 72 6F 73 6B 61
.Eߣ“B‚ˆ
Matroska stream file
1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
Runtime Software compressed disk image
WordStar Version 5.0/6.0 document
GZIP archive file
VLC Player Skin file
file using standard (Lempel-Ziv-Welch) compression
file using LZH (Lempel-Ziv-Huffman) compression
MapInfo Sea Chart
AIN Compressed Archive
21 3C 61 72 63 68 3E 0A
Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)
21 42 44 4E
Microsoft Outlook Exchange
Microsoft Outlook Exchange
Cerius2 file
23 20 44 69 73 6B 20 44
65 73 63 72 69 70 74 6F
VMware 4 Virtual Disk description file (split disk)
23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F
Microsoft Developer Studio project file
23 21 41 4D 52
Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
Codec, commonly audio format with GSM cell phones. (See .)
23 21 53 49 4C 4B 0A
developed by S also used by other applications.
23 3F 52 41 44 49 41 4E
Radiance High Dynamic Range image file
23 50 45 43 30 30 30 31
Brother/Babylock/Bernina Home Embroidery file
23 50 45 53 30
Brother/Babylock/Bernina Home Embroidery file
24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45
SPSS Data file
25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30
Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30 [0x1E])
25 50 44 46
PDF, FDF, AI
Adobe Portable Document Format, Forms Document Format, and Illustrator graphics files
0A 25 25 45 4F 46 (.%%EOF)
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.)
NOTE: There may be multiple end-of-file marks within the
file. When carving, be sure to get the last one.
25 62 69 74 6D 61 70
Fuzzy bitmap (FBM) file
28 54 68 69 73 20 66 69
6C 65 20 6D 75 73 74 20
62 65 20 63 6F 6E 76 65
72 74 65 64 20 77 69 74
68 20 42 69 6E 48 65 78
Macintosh BinHex 4 Compressed Archive
2A 2A 2A 20 20 49 6E 73
74 61 6C 6C 61 74 69 6F
6E 20 53 74 61 72 74 65
Symantec Wise Installer log file
[2 byte offset]
[2 byte offset]
Compressed archive file
2E 52 45 43
RealPlayer video file (V11 and later)
2E 52 4D 46
RealMedia streaming media file
2E 52 4D 46 00 00 00 12
RealAudio file
2E 72 61 FD 00
.raý.
RealAudio streaming media file
2E 73 6E 64
NeXT/Sun Microsystems µ-Law audio file
2F 2F 20 3C 21 2D 2D 20
3C 6D 64 62 3A 6D 6F 72
Thunderbird|Mozilla Mail Summary File
Microsoft security catalog file
30 00 00 00 4C 66 4C 65
Windows Event Viewer file
30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C
0&²u.fÏ.
¦Ù.ª.bÎl
ASF, WMA, WMV
Microsoft Windows Media Audio/Video File
30 31 4F 52 44 4E 41 4E
43 45 20 53 55 52 56 45
59 20 20 20 20 20 20 20
National Transfer Format Map File
30 37 30 37 30 nn
Archive created with the cpio utility (where nn
values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
standard ASCII format, new ASCII (aka SVR4) format, and CRC
format, respectively. (The
page has additional
information.) (Thanks to F. Webber for this....)
Microsoft Write file
32 03 10 00 00 00 00 00
00 00 80 00 00 00 FF 00
......ÿ.
Pfaff Home Embroidery file
34 CD B2 A1
4Ͳ¡
Extended tcpdump (libpcap) capture file (Linux/Unix)
37 7A BC AF 27 1C
7z¼¯'.
7-Zip compressed file
37 E4 53 96 C9 DB D6 07
7äS–ÛÖ.
zisofs compression format, recognized by some Linux kernels. See the
page for additional information.
38 42 50 53
Photoshop image file
3A 56 45 52 53 49 4F 4E
Surfplan kite project file
Advanced Stream redirector file
BizTalk XML-Data Reduced Schema file
3C 21 64 6F 63 74 79 70
AOL HTML mail file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D
Windows Visual Stylesheet XML file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E
XML User Interface Language file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E 0D 0A 3C
4D 4D 43 5F 43 6F 6E 73
6F 6C 65 46 69 6C 65 20
43 6F 6E 73 6F 6C 65 56
65 72 73 69 6F 6E 3D 22
Microsoft Management Console Snap-in Control file
3C 43 73 6F 75 6E 64 53
79 6E 74 68 65 73 69 7A
Csound music file
3C 4D 61 6B 65 72 46 69
Adobe FrameMaker file
3C 67 70 78 20 76 65 72
73 69 6F 6E 3D 22 31 2E
3C 7E 36 3C 5C 25 5F 30
67 53 71 68 3B
(aka BASE85) encoded file, sometimes used with PostScript and PDF.
Trailer: 7E 3E 0A (~&.)
[24 (0x18) byte offset]
3E 00 03 00 FE FF 09 0006
[24 (0x18) byte offset]
&...þÿ..
Quatro Pro for Windows 7.0 Notebook file
3F 5F 03 00
Windows Help index file
Windows Help file
[32 (0x20) byte offset]
40 40 40 20 00 00 40 4040 40
[32 (0x20) byte offset]
EndNote Library File
41 43 31 30
Generic AutoCAD drawing
NOTES on AutoCAD file headers: The 0x41-43-31-30 (AC10) is a generic header, occupying the first
four bytes in the file. The next two bytes give further indication about the version or subtype:
0x30-32 (02) — AutoCAD R2.5
0x30-33 (03) — AutoCAD R2.6
0x30-34 (04) — AutoCAD R9
0x30-36 (06) — AutoCAD R10
0x30-39 (09) — AutoCAD R11/R12
0x31-30 (10) — AutoCAD R13 (subtype 10)
0x31-31 (11) — AutoCAD R13 (subtype 11)
0x31-32 (12) — AutoCAD R13 (subtype 12)
0x31-33 (13) — AutoCAD R14 (subtype 13)
0x31-34 (14) — AutoCAD R14 (subtype 14)
0x31-35 (15) — AutoCAD R2000
0x31-38 (18) — AutoCAD R2004
0x32-31 (21) — AutoCAD R2007
Steganos Security Suite virtual secure drive
41 43 53 44
Miscellaneous AOL parameter and information files
file format. (The fourth byte is the version number.)
41 4D 59 4F
Harvard Graphics symbol graphic
41 4F 4C 20 46 65 65 64
AOL and AIM buddy list file
41 4F 4C 44 42
AOL database files: address book (ABY) and user configuration
data (MAIN.IDX)
41 4F 4C 49 44 58
AOL client preferences/settings file (MAIN.IND)
41 4F 4C 49 4E 44 45 58
AOL address book index file
41 4F 4C 56 4D 31 30 30
AOL personal file cabinet (PFC) file
for PFC file format information.
41 56 47 36 5F 49 6E 74
65 67 72 69 74 79 5F 44
61 74 61 62 61 73 65
AVG6 Integrity database file
41 72 43 01
FreeArc compressed file
42 41 41 44
NTFS Master File Table (MFT) entry (1,024 bytes)
42 45 47 49 4E 3A 56 43
41 52 44 0D 0A
vCard file
42 4C 49 32 32 33
Thomson Speedtouch series WLAN router firmware
NOTES on BLI/RBI file headers: The signature above is correct for the generic first six bytes.
Reportedly, the 7th & 8th bytes vary by version, and the 9th byte is always 0x30.
v6.0.7.1 (.bli) — 0x42-4C-49-32-32-33-51-4B-30 (BLI223QK0)
v7.4.1.7 (.bli) — 0x42-4C-49-32-32-33-51-48-30 (BLI223QH0)
v8.2.2.5 (.bli) — 0x42-4C-49-32-32-33-55-46-30 (BLI223UF0)
v8.4.3 (.bli/.rbi) — 0x42-4C-49-32-32-33-57-31-30 (BLI223W10)
Windows (or device-independent) bitmap image
NOTE: Bytes 2-5 contain the file length in little-endian order.
42 4F 4F 4B 4D 4F 42 49
Palmpilot resource file
42 50 47 FB
image format
BZ2, TAR.BZ2, TBZ2, TB2
compressed archive
42 65 67 69 6E 20 50 75
66 66 65 72 20 44 61 74
ASCII-armored encrypted archive
42 6C 69 6E 6B 20 62 79
20 44 2E 54 2E 53
BLINK compressed archive
43 23 2B 44 A4 43 4D A5
C#+D¤CM¥
RagTime document file
43 41 54 20
Electronic Arts'
43 42 46 49 4C 45
WordPerfect dictionary file (unconfirmed)
43 44 30 30 31
ISO-9660 CD Disc Image
This signature usually occurs at byte offset 31),
31), or 31).
More information can be found at
43 49 53 4F
Compressed ISO (CISO) CD image
43 4D 4D 4D 15 00 00 00
Windows 7 thumbcache_sr.db or other thumbcache file
(except thumbcache_idx.db)
43 4D 58 31
Corel Binary metafile
43 4F 4D 2B
COM+ Catalog file
43 4F 57 44
VMware 3 Virtual Disk (portion of a split disk) file
43 50 54 37 46 49 4C 45
Corel Photopaint file
43 50 54 46 49 4C 45
Corel Photopaint file
43 52 45 47
Windows 9x registry hive
43 52 55 53 48 20 76
Crush compressed archive
Macromedia Shockwave Flash player file (zlib compressed, SWF 6 and later).
43 61 6C 63 75 6C 75 78
20 49 6E 64 6F 6F 72 20
Calculux Indoor lighting design software project file
43 61 74 61 6C 6F 67 20
33 2E 30 30 00
WhereIsIt Catalog file
43 6C 69 65 6E 74 20 55
72 6C 43 61 63 68 65 20
4D 4D 46 20 56 65 72 20
Microsoft Internet Explorer cache file () file
43 72 65 61 74 69 76 65
20 56 6F 69 63 65 20 46
Creative Voice audio file
44 41 58 00
DAX Compressed CD image
44 42 46 48
Palm Zire photo database
44 4D 53 21
Amiga DiskMasher compressed archive
Amiga disk file
44 53 54 62
DST compressed file
DVR-Studio stream file
DVD info file
45 4C 49 54 45 20 43 6F
6D 6D 61 6E 64 65 72 20
Elite Plus Commander saved game file
45 4E 54 52 59 56 43 44
02 00 00 01 02 00 18 58
VideoVCD (GNU VCDImager) file
45 52 46 53 53 41 56 45
44 41 54 41 46 49 4C 45
Kroll EasyRecovery Saved Recovery State file
Microsoft Document Imaging file
45 56 46 09 0D 0A FF 00
EVF...ÿ.
Enn (where nn are numbers)
Expert Witness Compression Format (EWF) file, including EWF-E01
and EWF-S01, as used in EnCase and SMART evidence files.
45 56 46 32 0D 0A 81
Exnn (where nn are numbers)
EnCase& Evidence File Format Version 2 (Ex01).
45 6C 66 46 69 6C 65 00
Windows Vista event log file
45 86 00 00 06 00
E†....
Intuit QuickBooks backup file
46 41 58 43 4F 56 45 52
2D 56 45 52
Microsoft Fax Cover Sheet
46 44 42 48 00
Fiasco database definition file
46 45 44 46
(Unknown file type)
46 49 4C 45
NTFS Master File Table (MFT) entry (1,024 bytes)
46 4C 56 01
Flash video file
46 4F 52 4D
Electronic Arts'
46 4F 52 4D 00
Audio Interchange File
DAKX Compressed Audio
Macromedia Shockwave Flash player file (uncompressed). See
46 72 6F 6D 20 20 20 or
46 72 6F 6D 20 3F 3F 3F or
46 72 6F 6D 3A 20
A commmon file extension for e-mail files. Signatures shown here
are for Netscape, Eudora, and a generic signature, respectively.
EML is also used by Outlook Express and QuickMail.
TS, TSA, TSV
file. (This is not a lot to go on, but MPEG-2 Part 1
Transport (MP2T) files are reportedly broken into 188-byte packets and the
0x47 byte is the sync byte, so should repeat every 188 bytes in the file.)
47 46 31 50 41 54 43 48
Advanced Gravis Ultrasound patch file
47 49 46 38 37 61 or
47 49 46 38 39 61
Graphics interchange format file
Trailer: 00 3B (.;)
47 50 41 54
GIMP (GNU Image Manipulation Program) pattern file
Show Partner graphics file (not confirmed)
47 65 6E 65 74 65 63 20
4F 6D 6E 69 63 61 73 74
Genetec video archive
48 45 41 44 45 52 20 52
45 43 4F 52 44 2A 2A 2A
SAS Transport dataset file format
48 48 47 42 31
Harvard Graphics presentation file
Tagged Image File Format file
MPEG-1 Audio Layer 3 (MP3) audio file
49 44 33 03 00 00 00
Sprint Music Store audio file (for mobile devices)
49 49 1A 00 00 00 48 45
41 50 43 43 44 52 02 00
49 49 2A 00
Tagged Image File Format file (little
endian, i.e., LSB Intel)
49 49 2A 00 10 00 00 00
Canon digital camera RAW file ( | )
49 4D 4D 4D 15 00 00 00
Windows 7 thumbcache_idx.db file
49 53 63 28
Install Shield v5.x or 6.x compressed file
49 54 4F 4C 49 54 4C 53
Microsoft Reader eBook file
49 54 53 46
Microsoft Compiled HTML Help File
49 6E 6E 6F 20 53 65 74
75 70 20 55 6E 69 6E 73
74 61 6C 6C 20 4C 6F 67
20 28 62 29
Inno Setup Uninstall Log file
49 6E 74 65 72 40 63 74
69 76 65 20 50 61 67 65
Inter@ctive Pager Backup (BlackBerry) backup file
4A 41 52 43 53 00
JARCS compressed archive
4A 47 03 0E or
4A 47 04 0E
AOL ART file
For 0x4A-47-03-0E: D0 CB 00 00 (ÐË..)
For 0x4A-47-04-0E: CF C7 CB (ÏÇË)
VMware 4 Virtual Disk (portion of a split disk) file
4B 44 4D 56
VMware 4 Virtual Disk (monolitic disk) file
4B 47 42 5F 61 72 63 68
KGB archive
4B 49 00 00
Windows 9x printer spool file
4B 57 41 4A 88 F0 27 D1
KWAJˆð'Ñ
KWAJ file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
This command compresses a single file, replacing the last character in the file name
with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
FOO.BA$. (See the
page for more information.)
4C 00 00 00 01 14 02 00
. See also
relocatable
object code file for an Intel 386 or later/compatible processors
Tajima embroidery sticj image file
4C 49 53 54
Electronic Arts'
4C 4E 02 00
Windows Help index file
Windows Help file.
4C 56 46 09 0D 0A FF 00
LVF...ÿ.
Enn (where nn are numbers)
Logical File Evidence Format (EWF-L01) as used in later versions of
EnCase evidence files. See the .
4D 2D 57 20 50 6F 63 6B
65 74 20 44 69 63 74 69
Merriam-Webster Pocket Dictionary file
4D 41 52 31 00
Mozilla archive
4D 41 52 43
Microsoft/MSN MARC archive
4D 41 72 30 00
MAr compressed archive
4D 43 57 20 54 65 63 68
6E 6F 67 6F 6C 69 65 73
TargetExpress target file
4D 44 4D 50 93 A7
MDMPҤ
Windows heap dump file
Windows minidump file
4D 49 4C 45 53
Milestones v1.0 project management and scheduling software
(Also see "MV2C" and "MV214" signatures)
4D 4C 53 57
Skype localization data file
4D 4D 00 2A
Tagged Image File Format file (big
endian, i.e., LSB Motorola)
4D 4D 00 2B
BigTIFF Tagged Image File Format files >4 GB
4D 4D 4D 44 00 00
Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
for multimedia files that can be played on hand-held devices.
4D 52 56 4E
VMware BIOS (non-volatile RAM) state file.
4D 53 43 46
Microsoft cabinet file
Powerpoint Packaged Presentation
Microsoft Access Snapshot Viewer file
4D 53 46 54 02 00 01 00
OLE, SPSS, or Visual C++ type library file
4D 53 57 49 4D
Microsoft Windows Imaging Format file
4D 53 5F 56 4F 49 43 45
Sony Compressed Voice File
Sony Memory Stick Compressed Voice file
4D 54 68 64
Musical Instrument Digital Interface (MIDI) sound file
Yamaha Piano sound file
CD Stomper Pro label file
4D 56 32 31 34
Milestones v2.1b project management and scheduling software
(Also see "MILES" and "MV2C" signatures)
4D 56 32 43
Milestones v2.1a project management and scheduling software
(Also see "MILES" and "MV214" signatures)
COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS
Windows/DOS executable file
page for the structure of an EXE file,
with coverage of NE, TLINK, PE, self-extracting archives, and more.)
Note: MZ are the initals of Mark Zbikowski, designer of the DOS executable file format.
MS audio compression manager driver
Library cache file
Control panel application
ActiveX or OLE Custom Control
OLE object library
Screen saver
VisualBASIC application
Windows virtual device drivers
4D 5A 90 00 03 00 00 00
Acrobat plug-in
DirectShow filter
Audition graphic filter file (Adobe)
4D 5A 90 00 03 00 00 00
04 00 00 00 FF FF
....ÿÿ
ZoneAlam data file
4D 69 63 72 6F 73 6F 66
74 20 43 2F 43 2B 2B 20
Microsoft C++ debugging symbols file
4D 69 63 72 6F 73 6F 66
74 20 56 69 73 75 61 6C
20 53 74 75 64 69 6F 20
53 6F 6C 75 74 69 6F 6E
20 46 69 6C 65
Visual Studio .NET Solution file
[84 (0x54) byte offset]
4D 69 63 72 6F 73 6F 66
74 20 57 69 6E 64 6F 77
73 20 4D 65 64 69 61 20
50 6C 61 79 65 72 20 2D
[84 (0x54) byte offset]
Windows Media Player playlist
4D 73 52 63 66
VMapSource GPS Waypoint Database
4E 41 56 54 52 41 46 46
TomTom traffic data file
4E 42 2A 00
MS Windows journal file
4E 45 53 4D 1A 01
NES Sound file
4E 49 54 46 30
National Imagery Transmission Format (NITF) file
4E 61 6D 65 3A 20
Agent newsreader character map file
4F 50 43 4C 44 41 54
attachment
1Password 4 Cloud Keychain encrypted attachment
4F 50 4C 44 61 74 61 62
61 73 65 46 69 6C 65
Psion Series 3 Database file
4F 67 67 53 00 02 00 00
00 00 00 00 00 00
OGA, OGG, OGV, OGX
Ogg Vorbis Codec compressed Multimedia file
Visio/DisplayWrite 4 text file (unconfirmed)
50 00 00 00 20 00 00 00
Quicken QuickFinder Information File
Portable Graymap Graphic
50 41 43 4B
Quake archive file
50 41 47 45 44 55 36 34
Windows 64-bit memory dump
50 41 47 45 44 55 4D 50
Windows memory dump
PAX password protected bitmap
50 45 53 54
PestPatrol data/scan strings
50 47 50 64 4D 41 49 4E
PGP disk image
50 49 43 54 00 08
ADEX Corp. ChromaGraph Graphics Card Bitmap Graphic file
50 4B 03 04
PKZIP archive file ( | )
Trailer: filename 50 4B 17 characters 00 00 00
Trailer: (filename PK 17 characters ...)
Note: PK are the initals of Phil Katz, co-creator of the ZIP file format and author of PKZIP.
Apple Mac OS X Dashboard Widget, Aston Shell theme, Oolite eXpansion Pack,
Opera Widget, Pivot Style Template, Rockbox Theme package, Simple Machines
Forums theme, SubEthaEdit Mode, Trillian zipped skin, Virtual Skipper skin
J compressed file package for classes and data
Google Earth saved working session file
KWord document
ODT, ODP, OTT
OpenDocument text document, presentation, and text document template, respectively.
SXC, SXD, SXI, SXW
OpenOffice spreadsheet (Calc), drawing (Draw), presentation (Impress),
and word processing (Writer) files, respectively.
StarOffice spreadsheet
Windows Media compressed skin file
Mozilla Browser Archive
XML paper specification file
eXact Packager Models
50 4B 03 04 0A 00 02 00
Open Publication Structure eBook file. (Should also include the string:
mimetypeapplication/epub+zip)
50 4B 03 04 14 00 01 00
63 00 00 00 00 00
ZLock Pro encrypted ZIP
50 4B 03 04 14 00 06 00
DOCX, PPTX, XLSX
Microsoft Office Open XML Format (OOXML) Document
NOTE: There is no subheader for MS OOXML files as there is with
DOC, PPT, and XLS files. To better understand the format of these files,
rename any OOXML file to have a .ZIP extension and then unZIP
look at the resultant file named [Content_Types].xml to see the content
types. In particular, look for the &Override PartName= tag, where you
will find word, ppt, or xl, respectively.
Trailer: Look for 50 4B 05 06 (PK..) followed by 18 additional bytes
at the end of the file.
50 4B 03 04 14 00 08 0008 00
Java archive
50 4B 05 06
50 4B 07 08
PKZIP empty and multivolume archive file, respectively
[30 (0x1E) byte offset]
50 4B 4C 49 54 45
[30 (0x1E) byte offset]
PKLITE compressed ZIP archive (see also PKZIP)
[526 (0x20E) byte offset]
50 4B 53 70 58
[526 (0x20E) byte offset]
PKSFX self-extracting executable compressed file (see also PKZIP)
50 4D 43 43
Windows Program Manager group file
50 4E 43 49 55 4E 44 4F
Norton Disk Doctor undo file
50 4D 4F 43 43 4D 4F 43
Microsoft& Windows& User State Migration Tool (USMT).
applies to Windows XP and Windows Vista&, and
is for Windows 7.
50 55 46 58
encrypted archive
[92 (0x5C) byte offset]
51 45 4C 20
[92 (0x5C) byte offset]
Quicken data file
51 46 49 FB
QEMU Qcow Disk Image
51 57 20 56 65 72 2E 20
Quicken data file
[512 (0x200) byte offset]
52 00 6F 00 6F 00 74 00
20 00 45 00 6E 00 74 00
72 00 79 00
[512 (0x200) byte offset]
Outlook/Exchange message subheader (MS Office)
52 41 5A 41 54 44 42 31
Shareaza (Windows P2P client) thumbnail
52 45 47 45 44 49 54
Windows NT Registry and Registry Undo files
52 45 56 4E 55 4D 3A 2C
Antenna data file
52 49 46 46
Windows animated cursor
Corel Presentation Exchange (Corel 10 CMX) Metafile
CorelDraw document
Video CD MPEG or MPEG1 movie file
Micrografx Designer v4 graphic file
4X Movie video
52 49 46 46 xx xx xx xx
41 56 49 20 4C 49 53 54
Resource Interchange File Format -- , where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
43 44 44 41 66 6D 74 20
Resource Interchange File Format -- Compact Disc Digital
Audio (CD-DA) file, where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
51 4C 43 4D 66 6D 74 20
Resource Interchange File Format -- Qualcomm
PureVoice, where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
52 4D 49 44 64 61 74 61
Resource Interchange File Format -- , where xx xx xx xx is the file
size (little endian)
52 49 46 46 xx xx xx xx
57 41 56 45 66 6D 74 20
Resource Interchange File Format -- , where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
57 45 42 50
Google , where xx xx xx xx is the file size
52 54 53 53
Windows NT Netmon capture file
52 61 72 21 1A 07 00
RAR (v4.x) compressed archive file
52 61 72 21 1A 07 01 00
compressed archive file
52 65 74 75 72 6E 2D 50
61 74 68 3A 20
A commmon file header for e-mail files.
[4 byte offset]
53 43 43 41
[4 byte offset]
. The first four bytes indicate the OS:
0x11-00-00-00 = XP, 0x17-00-00-00 = Vista/Win7,
and 0x1A-00-00-00 = Win8.1 (and probably Win8, as well).
53 43 48 6C
Need for Speed: Underground Audio file
53 43 4D 49
Img Software Set Bitmap
53 44 50 58
Society of Motion Picture and Television Engineers (SMPTE)
Digital Picture Exchange (DPX) image file (big endian)
53 48 4F 57
Harvard Graphics DOS Ver. 2/x Presentation file
53 49 45 54 52 4F 4E 49
43 53 20 58 52 44 20 53
Sietronics CPI XRD document
53 49 4D 50 4C 45 20 20
3D 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 54
53 49 54 21 00
StuffIt compressed archive
53 4D 41 52 54 44 52 57
SmartDraw Drawing file
53 50 46 49 00
StorageCraft ShadownProtect backup file
53 50 56 42
MultiBit Bitcoin blockchain file
53 51 4C 4F 43 4F 4E 56
48 44 00 00 31 2E 30 00
DB2 conversion file
53 51 4C 69 74 65 20 66
6F 72 6D 61 74 20 33 00
SQLite database file
53 5A 20 88 F0 27 33 D1
SZ ˆð'3Ñ
QBASIC SZDD file header variant. (See the SZDD or KWAJ format entries
for additional information.)
53 5A 44 44 88 F0 27 33
SZDDˆð'3
SZDD file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
This command compresses a single file, replacing the last character in the file name
with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
FOO.BA$. (See the
page for more information.)
53 6D 62 6C
(Unconfirmed file type. Likely type is Harvard Graphics
Version 2.x graphic symbol or Windows SDK graphic symbol)
53 74 75 66 66 49 74 20
28 63 29 31 39 39 37 2D
StuffIt compressed archive
53 75 70 65 72 43 61 6C
SuperCalc worksheet
54 48 50 00
54 68 69 73 20 69 73 20
UNIX GNU Info Reader File
55 43 45 58
Unicode extensions
55 46 41 C6 D2 C1
UFAÆÒÁ
UFA compressed archive
55 46 4F 4F 72 62 69 74
UFO Capture v2 map file
56 43 50 43 48 30
Visual C PreCompiled header file
56 45 52 53 49 4F 4E 20
Visual Basic User-defined Control file
56 65 72 73 69 6F 6E 20
MapInfo Interchange Format file
57 4D 4D 50
Walkman MP3 container file
57 53 32 30 30 30
WordStar for Windows Ver. 2 document
[29,152 (0x71E0) byte offset]
57 69 6E 5A 69 70
[29,152 (0x71E0) byte offset]
WinZip compressed archive
57 6F 72 64 50 72 6F
Lotus WordPro document.
A commmon file extension for e-mail files. This variant is
for Exchange.
58 43 50 00
Cinco NetXRay, Network General Sniffer, and
Network Associates Sniffer capture file
58 50 43 4F 4D 0A 54 79
70 65 4C 69 62
XPCOM type libraries for the XPIDL compiler
58 50 44 53
Society of Motion Picture and Television Engineers (SMPTE)
Digital Picture Exchange (DPX) image file (little endian)
MS Publisher border
5A 4F 4F 20
ZOO compressed archive
Macromedia Shockwave Flash player file (LZMA compressed, SWF 13 and later).
5B 47 65 6E 65 72 61 6C
5D 0D 0A 44 69 73 70 6C
61 79 20 4E 61 6D 65 3D
3C 44 69 73 70 6C 61 79
4E 61 6D 65
MS Exchange 2007 extended configuration file
5B 4D 53 56 43
Microsoft Visual C++ Workbench Information File
5B 50 68 6F 6E 65 5D
Dial-up networking file
5B 56 45 52 5D or
5B 76 65 72 5D or
Lotus AMI Pro document
5B 56 4D 44 5D or
VocalTec VoIP media file
[2 byte offset]
5B 56 65 72 73 69 6F 6E
[2 byte offset]
(Unknown file type)
5B 57 69 6E 64 6F 77 73
20 4C 61 74 69 6E 20
Microsoft Code Page Translation file
5B 66 6C 74 73 69 6D 2E
Flight Simulator Aircraft Configuration file
5B 70 6C 61 79 6C 69 73
WinAmp Playlist file
5D FC C8 00
]üÈ.
Husqvarna Designer I Embroidery Machine file
5F 27 A8 89
_'¨‰
Jar archive
5F 43 41 53 45 5F
EnCase case file (and backup)
Compressed archive file
62 65 67 69 6E
UUencoded files start with a string:
& begin mode path
where mode is the set of permissions as used in
Linux/Unix and path is the name given to the decoded
file. (See this
page for more information.)
62 65 67 69 6E 2D 62 61
73 65 36 34
UUencoded BASE64 file
Trailer: 0A 3D 3D 3D 3D 0A (.====.)
62 70 6C 69 73 74
Binary property list (plist)
(NOTE: Next two bytes are the version number, currently
0x30-30, or "00")
63 61 66 66
63 6F 6E 65 63 74 69 78
Virtual PC Virtual HD image
63 75 73 68 00 00 00 02
Photoshop Custom Shape
64 00 00 00
Intel PROset/Wireless Profile
64 65 78 0A
Dalvik executable file (Android)
64 6E 73 2E
Audacity audio file
64 73 77 66 69 6C 65
Microsoft Visual Studio workspace file
66 49 00 00
Windows NT printer spool file
66 4C 61 43 00 00 00 22
Free Lossless Audio Codec file
[4 byte offset]
66 74 79 70 33 67 70 35
[4 byte offset]
MPEG-4 video files
[4 byte offset]
66 74 79 70 4D 34 41 20
[4 byte offset]
Apple Lossless Audio Codec file
[4 byte offset]
66 74 79 70 4D 53 4E 56
[4 byte offset]
MPEG-4 video file
[4 byte offset]
66 74 79 70 69 73 6F 6D
[4 byte offset]
ISO Base Media file (MPEG-4) v1
[4 byte offset]
66 74 79 70 6D 70 34 32
[4 byte offset]
MPEG-4 video|QuickTime file
[4 byte offset]
66 74 79 70 71 74 20 20
[4 byte offset]
QuickTime movie file
67 49 00 00
Windows 2000/XP printer spool file
67 69 6d 70 20 78 63 66
GNU Image Manipulation Program (GIMP) eXperimental Computing Facility (XCF)
image file
68 49 00 00
Windows Server 2003 printer spool file
6C 33 33 6C
Skype user data file (profile and contacts)
[4 byte offset]
6D 6F 6F 76
[4 byte offset]
QuickTime movie file
.MOV files have a complicated file signature. The string "moov" is the most common but I have also seen:
& 0x66-72-65-65 & free
& 0x6D-64-61-74 & mdat
& 0x77-69-64-65 & wide
And the following have been reported to me:
& 0x70-6E-6F-74 & pnot
& 0x73-6B-69-70 & skip
Furthermore, if you look at byte position xxxxxxxx+4 (where xxxxxxxx is bytes 0-3 of the header), you
will find one (or more!) of th the string "free" seems to be the most common. For
more information, see the
page. (Thanks to D. Wright for getting me started on this!)
6D 73 46 69 6C 74 65 72
4C 69 73 74
Internet Explorer v11 Tracking Protection List file
6D 75 6C 74 69 42 69 74
2E 69 6E 66 6F
MultiBit Bitcoin wallet information file
Short Message Service (SMS), or text, message stored on a
Subscriber Identification Module (SIM).
6F 70 64 61 74 61 30 31
1Password 4 Cloud Keychain encrypted data
72 65 67 66
Windows NT registry hive file
72 69 66 66
Sonic Foundry Acid Music File (Sony)
72 74 73 70 3A 2F 2F
RealMedia metafile
73 6C 68 21 or
73 6C 68 2E
Allegro Generic Packfile Data file (0x21 = compressed,
0x2E = uncompressed)
PalmOS SuperMemo file
73 6F 6C 69 64
for 3D printing.
73 72 63 64 6F 63 69 64
CALS raster bitmap file
73 7A 65 7A
PowerBASIC Debugger Symbols file
[60 (0x3C) byte offset]
74 42 4D 50 4B 6E 57 72
[60 (0x3C) byte offset]
PathWay Map file, used with GPS devices
[257 (0x101) byte offset]
75 73 74 61 72
[257 (0x101) byte offset]
Tape Archive file ()
76 2F 31 01
OpenEXR bitmap image format
76 32 30 30 33 2E 31 30
0D 0A 30 0D 0A
Qimage filter
78 01 73 0D 62 62 60
Mac OS X Disk Copy Disk Image file
78 61 72 21
7A 62 65 78
ZoomBrowser Image Index file ()
7B 0D 0A 6F 20
Windows application log
7B 5C 70 77 69
Microsoft Windows Mobile personal note file
7B 5C 72 74 66 31
Rich text format word processing file
Trailer: 5C 70 61 72 20 7D 7D (\par }})
7C 4B C3 74 E1 C8 53 A4
79 B9 01 1D FC 4F DD 13
|KÃtáÈS¤
y¹..üOÝ.
Huskygram, Poem, or Singer embroidery design file
7E 42 4B 00
Corel Paint Shop Pro image file
7E 74 2C 01 50 70 02 4D
52 01 00 00 00 08 00 00
00 01 00 00 31 00 00 00
31 00 00 00 43 01 FF 00
01 00 08 00 01 00 00 00
7e 74 2c 01
1...C.ÿ.
Reportedly a proprietary recording system, possibly a
Digital Watchdog DW-TP-500G unit.
7F 45 4C 46
Relocatable object code
80 00 00 20 03 12 04
Dreamcast audio file
80 2A 5F D7
Kodak Cineon image file
81 32 84 C1 85 05 D0 11
B2 90 00 AA 00 3C F6 76
.2„Á….Ð.
²..ª.&öv
Outlook Express address book (Win95)
.Í«
WordPerfect text file
†Ý{lower_case letter}
Possibly, maybe, might be a fragment of an Ethernet frame carrying
an IPv6 packet. See .
89 50 4E 47 0D 0A 1A 0A
‰PNG....
Trailer: 49 45 4E 44 AE 42 60 82 (IEND®B`‚...)
8A 01 09 00 00 00 E1 08
00 00 99 19
Š.....á.
MS Answer Wizard file
91 33 48 46
Hamarsoft HAP 3.x compressed archive
PGP secret keyring file
97 4A 42 32 0D 0A 1A 0A
—JB2....
JBOG2 image file.
Trailer: 03 33 00 01 00 00 00 00 (.3......)
GNU Privacy Guard (GPG) public keyring
PGP public keyring file
9C CB CB 8D 13 75 D2 11
91 58 00 C0 4F 79 56 A4
œËË..UÒ.
‘X.ÀOyV¤
Outlook address file
[512 (0x200) byte offset]
A0 46 1D F0
[512 (0x200) byte offset]
 F.ð
PowerPoint presentation subheader (MS Office)
A1 B2 C3 D4
¡²ÃÔ
tcpdump (libpcap) capture file (Linux/Unix)
A1 B2 CD 34
¡²Í4
Extended tcpdump (libpcap) capture file (Linux/Unix)
A9 0D 00 00 00 00 00 00
©.......
Access Data FTK evidence file
AC 9E BD 8F 00 00
¬.½...
Quicken data file
’
Java serialization data (see )
AC ED 00 05 73 72 00 12
62 67 62 6C 69 74 7A 2E
’..sr..
BGBlitz (professional Backgammon software) position database file
B0 4D 46 43
Windows 95 password file
B1 68 DE 3A
±hÞ:
Graphics Multipage PCX bitmap file
B4 6E 68 44
Acronis True Image file
B5 A2 B0 B3 B3 B0 A5 B5
µ¢°³³°¥µ
Windows calendar file
BE 00 00 00 AB 00 00 00
00 00 00 00 00
¾...«...
MS Write file
BE BA FE CA 0F 50 61 6C
6D 53 47 20 44 61 74 61
¾ºþÊ.Pal
Palm Desktop DateBook file
C3 AB CD AB
ëͫ
MS Agent Character file
C5 D0 D3 C6
ÅÐÓÆ
Adobe encapsulated PostScript file
C8 00 79 00
Jeppesen FliteLog file
CA FE BA BE
Êþº¾
Java bytecode file (also used by Apple iOS apps)
CD 20 AA AA 02 00 00 00
Í ªª....
Norton Anti-Virus quarantined virus file
CE CE CE CE
ÎÎÎÎ
CE FA ED FE
Îúíþ
binary file (32-bit, where target system has reverse byte
ordering from host running compiler)
CF 11 E0 A1 B1 1A E1 00
Ï.ࡱ.á.
Perfect Office document
[Note similarity to MS Office header, below]
CF AD 12 FE
Ï­.þ
Outlook Express e-mail folder
CF FA ED FE
Ïúíþ
binary file (64-bit, where target system has reverse byte
ordering from host running compiler)
D0 CF 11 E0 A1 B1 1A E1
ÐÏ.ࡱ.á
, DOT, PPS, , XLA, , WIZ
An Object Linking and Embedding (OLE) Compound File (CF) (i.e., )
file format, known as Compound Binary File format by Microsoft, used by
Microsoft Office 97-2003 applications (Word, Powerpoint, Excel, Wizard).
[See also Excel, Outlook, PowerPoint, and Word "subheaders" at byte offset 512 (0x200).]
There appear to several subheader formats and a dearth of documentation.
There have been reports that there are different subheaders for Windows and Macversions of MS Office but I cannot confirm that.]
Password-protected DOCX, XLSX, and PPTX files also use this signature those filesare saved as OLECF files.
[Note the similarity between D0 CF 11 E0 and the word "docfile"!]
CaseWare Working Papers compressed client file
Access project file
Lotus/IBM Approach 97 file
MSWorks database file
Microsoft Common Console Document
Microsoft Outlook/Exchange Message
Microsoft Installer package
Minitab data file
Developer Studio File Workspace Options file
MS Publisher file
QuickBooks Portable Company File
Revit Project file
Visual Studio Solution User Options file
SPSS output file
Visio file
MSWorks text document
D2 0A 00 00
GN Nettest WinPharoah filter file
AOL history (ARL) and typed URL (AUT) files
D4 C3 B2 A1
Ôò¡
WinDump (winpcap) capture file (Windows)
D7 CD C6 9A
×ÍÆš
Windows graphics metafile
DB A5 2D 00
Û¥-.
Word 2.0 file
ÜÜ
Corel color palette file
Üþ
eFax file format
E3 10 00 01 00 00 00 00
ã.......
Amiga Icon file
E3 82 85 96
ã‚…–
Windows 98 password file
E4 52 5C 7B 8C D8 A7 4D
AE B1 53 78 D0 29 96 D3
äR\{ŒØ§M
®±SxÐ)–Ó
Microsoft OneNote note
Windows executable file
EB 3C 90 2A
GEM Raster file
EB 52 90 2D 46 56 45 2D
ëR.-FVE-
Header of boot sector in BitLocker protected volume (Vista)
EB 58 90 2D 46 56 45 2D
ëX.-FVE-
Header of boot sector in BitLocker protected volume (Windows 7)
[512 (0x200) byte offset]
EC A5 C1 00
[512 (0x200) byte offset]
ì¥Á.
Word document subheader (MS Office)
ED AB EE DB
í«îÛ
RedHat Package Manager file

Byte-order mark (BOM) for 8-bit Unicode Transformation Format
(UTF-8) files.
(See the .)
[At a cluster boundary]
[At a cluster boundary]
ðÿÿ
FAT12 File Allocation Table
[At a cluster boundary]
F8 FF FF FF
[At a cluster boundary]
øÿÿÿ
FAT16 File Allocation Table
[At a cluster boundary]
F8 FF FF 0F FF FF FF 0F
[At a cluster boundary]
øÿÿ.ÿÿÿ.
FAT32 File Allocation Table
[At a cluster boundary]
F8 FF FF 0F FF FF FF FF
[At a cluster boundary]
øÿÿ.ÿÿÿÿ
FAT32 File Allocation Table
F9 BE B4 D9
ù¾´Ù
Bitcoin-Qt blockchain block file
FD 37 7A 58 5A 00
ý7zXZ.
XZ archive file
[512 (0x200) byte offset]
FD FF FF FF 02
[512 (0x200) byte offset]
ýÿÿÿ.
MS Publisher file subheader
[512 (0x200) byte offset]
FD FF FF FF 04
[512 (0x200) byte offset]
ýÿÿÿ.
QuickBooks Portable Company File
Visual Studio Solution User Options subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF nn nn 00 00
[512 (0x200) byte offset]
ýÿÿÿ....
PowerPoint presentation subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF nn 00
[512 (0x200) byte offset]
ýÿÿÿ..
[512 (0x200) byte offset]
FD FF FF FF nn 02
[512 (0x200) byte offset]
ýÿÿÿ..
Excel spreadsheet subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF 20 00 00 00
[512 (0x200) byte offset]
ýÿÿÿ ...
Developer Studio File Workspace Options subheader (MS Office)
Excel spreadsheet subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF xx xx xx xx
xx xx xx xx 04 00 00 00
[512 (0x200) byte offset]
ýÿÿÿ....
Thumbs.db subheader (MS Office)
FE ED FA CE
þíúÎ
binary file (32-bit)
FE ED FA CF
þíúÏ
binary file (64-bit)
FE ED FE ED
þíþí
þï
Symantex Ghost image file
þÿ
Byte-order mark (BOM) for 16-bit Unicode Transformation Format/
2-octet Universal Character Set (UTF-16/UCS-2), big-endian files.
(See the .)
Windows executable (SYS) file
FF 00 02 00 04 04 05 54
ÿ......T
Works for Windows spreadsheet file
QuickReport Report file
FF 46 4F 4E 54
ÿFONT
Windows international code page
FF 4B 45 59 42 20 20 20
ÿKEYB
Keyboard driver file
FF 57 50 43
WP, WPD, WPG, WPP, WP5, WP6
WordPerfect text and graphics file
FF D8 FF E0 xx xx 4A 46
ÿØÿà..JF
JFIF, JPE, JPEG, JPG
Trailer: FF D9 (ÿÙ)
FF D8 FF E1 xx xx 45 78
ÿØÿá..Ex
Digital camera JPG using
Trailer: FF D9 (ÿÙ)
(P. Alvarez, IJDE, 2(3), Winter 2004) and
FF D8 FF E8 xx xx 53 50
49 46 46 00
ÿØÿè..SP
Trailer: FF D9 (ÿÙ)
NOTES on JPEG file headers: It appears that one can safely say that all JPEG files start with the three hex digits 0xFF-D8-FF.
The fourth digit is also indicative of JPEG content. Various options include:
0xFF-D8-FF-DB — Samsung D807 JPEG file.
0xFF-D8-FF-E0 — Shown above. .
0xFF-D8-FF-E1 — Shown above. Standard JPEG/Exif file.
0xFF-D8-FF-E2 — Canon EOS-1D JPEG file.
0xFF-D8-FF-E3 — Samsung D500 JPEG file.
0xFF-D8-FF-E8 — Shown above. .
MPEG, MPG, MP3
MPEG audio file frame
ÿñ
MPEG-4 Advanced Audio Coding (AAC) Low Complexity (LC) audio file
ÿù
MPEG-2 Advanced Audio Coding (AAC) Low Complexity (LC) audio file
ÿþ
Windows Registry file
Byte-order mark (BOM) for 16-bit Unicode Transformation Format/
2-octet Universal Character Set (UTF-16/UCS-2), little-endian files.
(See the .)
FF FE 00 00
ÿþ..
Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), little-endian files.
(See the .)
FF FE 23 00 6C 00 69 00
6E 00 65 00 20 00 31 00
ÿþ#.l.i.
Windows MSinfo file
FF FF FF FF
ÿÿÿÿ
DOS system driver
, author of the
(primarily for the "subheaders" for many of the file types here), and the people at
for their permission to incorporate their lists of file signatures.
Finally, Dr. Nicole Beebe from The University of Texas at San Antonio posted samples of more than 32 file types at the Digital Corpora, which I used for verification and additional signatures. These files were used to develop the . The file samples can be downloaded from the
COPYRIGHT NOTICE
All information on this page & , Gary C. Kessler. Permission to use the material here is extended to any of this page's visitors, as long as appropriate attribution is provided and the information is not altered in any way without express written permission of the author.}
FILE SIGNATURES TABLE
23 July 2016
This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I had found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list in 2002. See also Wikipedia's . Comments, additions, and queries can be sent to Gary Kessler at .
This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:
, The Programmer's File and Data Resource
Some other useful information:
page contains a custom signature file based upon this list, for use with FTK, Scalpel, Simple Carver, Simple Carver Lite, and TrID.
Web site searches a database based upon file extension or file signature.
Tim Coakley's
site, with Filesig Manager and Simple Carver. Also, see Tim's
page, "a repository of information used to identify specific SQLite databases and properties for research purposes."
Marco Pontello's
utility designed to identify file types from their binary signatures.
The National Archives'
site provides on-line information about data file formats and their supporting software products, as well as their multi-platform
Additional details on graphics file formats can be found at
Additional details on audio and video file formats can be found at the
Another collection of many types of file format specifications can be found at Alex Kirk's .
Shaul Zevin's
page presents an ontology on which his
tool is built, a Web-based tool to classify a file by signature.
If you are using a Linux/Mac OS X/Unix system, you can use the
command to determine the file type based upon the file signature, per the system's magic file.
And, one last and final item — if you are searching for network traffic in raw binary files (e.g., RAM or unallocated space), see .
Hex Signature
& & & & & &ASCII Signature
File Extension
& & & & & &File Description
Truevision Targa Graphic file
54 52 55 45 56 49 53 49 & TRUEVISI
4F 4E 2D 58 46 49 4C 45 & ON-XFILE
2E 00 & & & & & & & & & & ..
IBM Storyboard bitmap file
Apple QuickTime movie file
Windows Program Information File
Mac Stuffit Self-Extracting Archive
IRIS OCR data file
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
Compucon/Singer embroidery design file
[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
[11 byte offset]
Palmpilot Database/Document File
[512 (0x200) byte offset]
00 00 00 00 00 00 00 00
[512 (0x200) byte offset]
Revit Project File subheader
00 00 00 00 14 00 00 00
Windows Disk Image file
[8 byte offset]
00 00 00 00 62 31 05 00
09 00 00 00 00 20 00 00
00 09 00 00 00 00 00 00
[8 byte offset]
Bitcoin Core wallet.dat file
00 00 00 0C 6A 50 20 20
Various JPEG-2000 image file formats
00 00 00 14 66 74 79 70
3GG, 3GP, 3G2
3rd Generation Partnership Project 3GPP multimedia files
00 00 00 14 66 74 79 70
69 73 6F 6D
ISO Base Media file (MPEG-4) v1
00 00 00 14 66 74 79 70
71 74 20 20
QuickTime movie file
00 00 00 18 66 74 79 70
33 67 70 35
MPEG-4 video files
00 00 00 18 66 74 79 70
6D 70 34 32
MPEG-4 video/QuickTime file
00 00 00 1C 66 74 79 70
4D 53 4E 56 01 29 00 46
4D 53 4E 56 6D 70 34 32
MPEG-4 video file
00 00 00 20 66 74 79 70
3GG, 3GP, 3G2
3rd Generation Partnership Project 3GPP2 multimedia files
00 00 00 20 66 74 79 70
4D 34 41 20
Apple Lossless Audio Codec file
00 00 01 00
Windows icon file
Windows NT/2000/XP printer spool file
00 00 01 Bx
MPEG video file
00 00 01 B7 (...·)
00 00 01 BA
....º
DVD Video Movie File (video/dvd, video/mpeg) or DVD MPEG2
00 00 01 B9 (...¹)
00 00 02 00
Windows cursor file
QuattroPro for Windows Spreadsheet file
00 00 02 00 06 04 06 00
08 00 00 00 00 00
Lotus 1-2-3 spreadsheet (v1) file
00 00 03 F3
executable file
00 00 1A 00 00 10 04 00
00 00 00 00
Lotus 1-2-3 spreadsheet (v3) file
00 00 1A 00 02 10 04 00
00 00 00 00
Lotus 1-2-3 spreadsheet (v4, v5) file
00 00 1A 00 05 10 04
Lotus 1-2-3 spreadsheet (v9) file
00 00 49 49 58 50 52 or
00 00 4D 4D 58 50 52
Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
th 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.
00 00 FE FF
..þÿ
Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the .)
[6 byte offset]
00 00 FF FF FF FF
[6 byte offset]
..ÿÿÿÿ
Windows Help file
00 01 00 00 00
TrueType font file
00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
Microsoft Money file
00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
Microsoft Access 2007 file
00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
Microsoft Access file
00 01 00 08 00 01 00 01
Ventura Publisher/GEM VDI Image Format Bitmap file
OpenFlight 3D file
00 01 42 41
Palm Address Book Archive file
00 01 42 44
Palm DateBook Archive file
00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00
...Ò....
Netscape Navigator (v4) database file
00 0D BB A0
..» 
Mbox table of contents file. (NOTE: The next four bytes
appear to be the number of e-mails in the associated mbox file.)
FLIC Animation file
00 14 00 00 01 02 xx xx
BIOS details in RAM images
00 1E 84 90 00 00 00 00
..„.....
Netscape Communicator (v4) mail folder
00 20 AF 30
Wii images container
00 5C 41 B1 FF
.\A±ÿ
Mujahideen Secrets 2 encrypted file
[512 (0x200) byte offset]
00 6E 1E F0
[512 (0x200) byte offset]
PowerPoint presentation subheader (MS Office)
Adobe Flash shared object file (e.g., Flash cookies)
00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01
.ÿÿÿÿÿÿÿ
ÿÿÿ.....
Alcohol 120% CD image
01 00 00 00
Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)
01 00 00 00 01
Unknown type picture file
01 00 09 00 00 03
Windows Metadata file (Win 3.x format)
01 00 02 00
Webex Advanced Recording Format files.
01 00 39 30
Firebird and Interbase database files, respectively. See
for more information.
01 01 47 19 A4 00 00 00
00 00 00 00
..G.#xA4...
secure e-mail Message Base Index file
01 0F 00 00
Microsoft SQL Server 2000 database
Novell LANalyzer capture file
01 DA 01 01 00 03
.Ú....
Silicon Graphics RGB Bitmap
01 FF 02 04 03 02
.ÿ....
Micrografx vector graphic file
02 64 73 73
Digital Speech Standard (Olympus, Grundig, & Phillips)
MapInfo Native Data Format
dBASE III file
03 00 00 00
Quicken price history file
03 00 00 00 41 50 50 52
Approach index file
dBASE IV data file
04 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00 or
05 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00
file. NOTE: Bytes 12-13
indicate the size of each INFO2 the most common
value is 0x20-03 (0x0320 = 800 bytes).
06 06 ED F5 D8 1D 46 E5
BD 31 EF E7 FE 74 B7 1D
..íõØ.Få
½1ïçþt·.
Adobe InDesign document.
A common signature and file extension for many drawing
07 53 4B 46
SkinCrafter skin file
07 64 74 32 64 64 74 64
DesignTools 2D Design file
dBASE IV or dBFast configuration file
Possibly, maybe, might be a fragment of an Ethernet frame carrying
an IPv4 packet. See .
[512 (0x200) byte offset]
09 08 10 00 00 06 05 00
[512 (0x200) byte offset]
Excel spreadsheet subheader (MS Office)
0A nn 01 01
ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)
0A 16 6F 72 67 2E 62 69
74 63 6F 69 6E 2E 70 72
MultiBit Bitcoin wallet file
Monochrome Picture TIFF bitmap file (unconfirmed)
0D 44 4F 43
DeskMate Document file
0E 4E 65 72 6F 49 53 4F
Nero CD Compilation
0E 57 4B 53
DeskMate Worksheet
[512 (0x200) byte offset]
0F 00 E8 03
[512 (0x200) byte offset]
PowerPoint presentation subheader (MS Office)
10 00 00 00
Easy CD Creator 5 Layout file
Lotus Notes database template
1A 00 00 04 00 00
Lotus Notes database
LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)
Compressed archive file
(often associated with Quake Engine games)
1A 35 01 00
GN Nettest WinPharoah capture file
1A 45 DF A3
.Eߣ
WebM video file
1A 45 DF A3 93 42 82 88
6D 61 74 72 6F 73 6B 61
.Eߣ“B‚ˆ
Matroska stream file
1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
Runtime Software compressed disk image
WordStar Version 5.0/6.0 document
GZIP archive file
VLC Player Skin file
file using standard (Lempel-Ziv-Welch) compression
file using LZH (Lempel-Ziv-Huffman) compression
MapInfo Sea Chart
AIN Compressed Archive
21 3C 61 72 63 68 3E 0A
Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)
21 42 44 4E
Microsoft Outlook Exchange
Microsoft Outlook Exchange
Cerius2 file
23 20 44 69 73 6B 20 44
65 73 63 72 69 70 74 6F
VMware 4 Virtual Disk description file (split disk)
23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F
Microsoft Developer Studio project file
23 21 41 4D 52
Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
Codec, commonly audio format with GSM cell phones. (See .)
23 21 53 49 4C 4B 0A
developed by S also used by other applications.
23 3F 52 41 44 49 41 4E
Radiance High Dynamic Range image file
23 50 45 43 30 30 30 31
Brother/Babylock/Bernina Home Embroidery file
23 50 45 53 30
Brother/Babylock/Bernina Home Embroidery file
24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45
SPSS Data file
25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30
Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30 [0x1E])
25 50 44 46
PDF, FDF, AI
Adobe Portable Document Format, Forms Document Format, and Illustrator graphics files
0A 25 25 45 4F 46 (.%%EOF)
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.)
NOTE: There may be multiple end-of-file marks within the
file. When carving, be sure to get the last one.
25 62 69 74 6D 61 70
Fuzzy bitmap (FBM) file
28 54 68 69 73 20 66 69
6C 65 20 6D 75 73 74 20
62 65 20 63 6F 6E 76 65
72 74 65 64 20 77 69 74
68 20 42 69 6E 48 65 78
Macintosh BinHex 4 Compressed Archive
2A 2A 2A 20 20 49 6E 73
74 61 6C 6C 61 74 69 6F
6E 20 53 74 61 72 74 65
Symantec Wise Installer log file
[2 byte offset]
[2 byte offset]
Compressed archive file
2E 52 45 43
RealPlayer video file (V11 and later)
2E 52 4D 46
RealMedia streaming media file
2E 52 4D 46 00 00 00 12
RealAudio file
2E 72 61 FD 00
.raý.
RealAudio streaming media file
2E 73 6E 64
NeXT/Sun Microsystems µ-Law audio file
2F 2F 20 3C 21 2D 2D 20
3C 6D 64 62 3A 6D 6F 72
Thunderbird|Mozilla Mail Summary File
Microsoft security catalog file
30 00 00 00 4C 66 4C 65
Windows Event Viewer file
30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C
0&²u.fÏ.
¦Ù.ª.bÎl
ASF, WMA, WMV
Microsoft Windows Media Audio/Video File
30 31 4F 52 44 4E 41 4E
43 45 20 53 55 52 56 45
59 20 20 20 20 20 20 20
National Transfer Format Map File
30 37 30 37 30 nn
Archive created with the cpio utility (where nn
values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
standard ASCII format, new ASCII (aka SVR4) format, and CRC
format, respectively. (The
page has additional
information.) (Thanks to F. Webber for this....)
Microsoft Write file
32 03 10 00 00 00 00 00
00 00 80 00 00 00 FF 00
......ÿ.
Pfaff Home Embroidery file
34 CD B2 A1
4Ͳ¡
Extended tcpdump (libpcap) capture file (Linux/Unix)
37 7A BC AF 27 1C
7z¼¯'.
7-Zip compressed file
37 E4 53 96 C9 DB D6 07
7äS–ÛÖ.
zisofs compression format, recognized by some Linux kernels. See the
page for additional information.
38 42 50 53
Photoshop image file
3A 56 45 52 53 49 4F 4E
Surfplan kite project file
Advanced Stream redirector file
BizTalk XML-Data Reduced Schema file
3C 21 64 6F 63 74 79 70
AOL HTML mail file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D
Windows Visual Stylesheet XML file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E
XML User Interface Language file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E 0D 0A 3C
4D 4D 43 5F 43 6F 6E 73
6F 6C 65 46 69 6C 65 20
43 6F 6E 73 6F 6C 65 56
65 72 73 69 6F 6E 3D 22
Microsoft Management Console Snap-in Control file
3C 43 73 6F 75 6E 64 53
79 6E 74 68 65 73 69 7A
Csound music file
3C 4D 61 6B 65 72 46 69
Adobe FrameMaker file
3C 67 70 78 20 76 65 72
73 69 6F 6E 3D 22 31 2E
3C 7E 36 3C 5C 25 5F 30
67 53 71 68 3B
(aka BASE85) encoded file, sometimes used with PostScript and PDF.
Trailer: 7E 3E 0A (~&.)
[24 (0x18) byte offset]
3E 00 03 00 FE FF 09 0006
[24 (0x18) byte offset]
&...þÿ..
Quatro Pro for Windows 7.0 Notebook file
3F 5F 03 00
Windows Help index file
Windows Help file
[32 (0x20) byte offset]
40 40 40 20 00 00 40 4040 40
[32 (0x20) byte offset]
EndNote Library File
41 43 31 30
Generic AutoCAD drawing
NOTES on AutoCAD file headers: The 0x41-43-31-30 (AC10) is a generic header, occupying the first
four bytes in the file. The next two bytes give further indication about the version or subtype:
0x30-32 (02) — AutoCAD R2.5
0x30-33 (03) — AutoCAD R2.6
0x30-34 (04) — AutoCAD R9
0x30-36 (06) — AutoCAD R10
0x30-39 (09) — AutoCAD R11/R12
0x31-30 (10) — AutoCAD R13 (subtype 10)
0x31-31 (11) — AutoCAD R13 (subtype 11)
0x31-32 (12) — AutoCAD R13 (subtype 12)
0x31-33 (13) — AutoCAD R14 (subtype 13)
0x31-34 (14) — AutoCAD R14 (subtype 14)
0x31-35 (15) — AutoCAD R2000
0x31-38 (18) — AutoCAD R2004
0x32-31 (21) — AutoCAD R2007
Steganos Security Suite virtual secure drive
41 43 53 44
Miscellaneous AOL parameter and information files
file format. (The fourth byte is the version number.)
41 4D 59 4F
Harvard Graphics symbol graphic
41 4F 4C 20 46 65 65 64
AOL and AIM buddy list file
41 4F 4C 44 42
AOL database files: address book (ABY) and user configuration
data (MAIN.IDX)
41 4F 4C 49 44 58
AOL client preferences/settings file (MAIN.IND)
41 4F 4C 49 4E 44 45 58
AOL address book index file
41 4F 4C 56 4D 31 30 30
AOL personal file cabinet (PFC) file
for PFC file format information.
41 56 47 36 5F 49 6E 74
65 67 72 69 74 79 5F 44
61 74 61 62 61 73 65
AVG6 Integrity database file
41 72 43 01
FreeArc compressed file
42 41 41 44
NTFS Master File Table (MFT) entry (1,024 bytes)
42 45 47 49 4E 3A 56 43
41 52 44 0D 0A
vCard file
42 4C 49 32 32 33
Thomson Speedtouch series WLAN router firmware
NOTES on BLI/RBI file headers: The signature above is correct for the generic first six bytes.
Reportedly, the 7th & 8th bytes vary by version, and the 9th byte is always 0x30.
v6.0.7.1 (.bli) — 0x42-4C-49-32-32-33-51-4B-30 (BLI223QK0)
v7.4.1.7 (.bli) — 0x42-4C-49-32-32-33-51-48-30 (BLI223QH0)
v8.2.2.5 (.bli) — 0x42-4C-49-32-32-33-55-46-30 (BLI223UF0)
v8.4.3 (.bli/.rbi) — 0x42-4C-49-32-32-33-57-31-30 (BLI223W10)
Windows (or device-independent) bitmap image
NOTE: Bytes 2-5 contain the file length in little-endian order.
42 4F 4F 4B 4D 4F 42 49
Palmpilot resource file
42 50 47 FB
image format
BZ2, TAR.BZ2, TBZ2, TB2
compressed archive
42 65 67 69 6E 20 50 75
66 66 65 72 20 44 61 74
ASCII-armored encrypted archive
42 6C 69 6E 6B 20 62 79
20 44 2E 54 2E 53
BLINK compressed archive
43 23 2B 44 A4 43 4D A5
C#+D¤CM¥
RagTime document file
43 41 54 20
Electronic Arts'
43 42 46 49 4C 45
WordPerfect dictionary file (unconfirmed)
43 44 30 30 31
ISO-9660 CD Disc Image
This signature usually occurs at byte offset 31),
31), or 31).
More information can be found at
43 49 53 4F
Compressed ISO (CISO) CD image
43 4D 4D 4D 15 00 00 00
Windows 7 thumbcache_sr.db or other thumbcache file
(except thumbcache_idx.db)
43 4D 58 31
Corel Binary metafile
43 4F 4D 2B
COM+ Catalog file
43 4F 57 44
VMware 3 Virtual Disk (portion of a split disk) file
43 50 54 37 46 49 4C 45
Corel Photopaint file
43 50 54 46 49 4C 45
Corel Photopaint file
43 52 45 47
Windows 9x registry hive
43 52 55 53 48 20 76
Crush compressed archive
Macromedia Shockwave Flash player file (zlib compressed, SWF 6 and later).
43 61 6C 63 75 6C 75 78
20 49 6E 64 6F 6F 72 20
Calculux Indoor lighting design software project file
43 61 74 61 6C 6F 67 20
33 2E 30 30 00
WhereIsIt Catalog file
43 6C 69 65 6E 74 20 55
72 6C 43 61 63 68 65 20
4D 4D 46 20 56 65 72 20
Microsoft Internet Explorer cache file () file
43 72 65 61 74 69 76 65
20 56 6F 69 63 65 20 46
Creative Voice audio file
44 41 58 00
DAX Compressed CD image
44 42 46 48
Palm Zire photo database
44 4D 53 21
Amiga DiskMasher compressed archive
Amiga disk file
44 53 54 62
DST compressed file
DVR-Studio stream file
DVD info file
45 4C 49 54 45 20 43 6F
6D 6D 61 6E 64 65 72 20
Elite Plus Commander saved game file
45 4E 54 52 59 56 43 44
02 00 00 01 02 00 18 58
VideoVCD (GNU VCDImager) file
45 52 46 53 53 41 56 45
44 41 54 41 46 49 4C 45
Kroll EasyRecovery Saved Recovery State file
Microsoft Document Imaging file
45 56 46 09 0D 0A FF 00
EVF...ÿ.
Enn (where nn are numbers)
Expert Witness Compression Format (EWF) file, including EWF-E01
and EWF-S01, as used in EnCase and SMART evidence files.
45 56 46 32 0D 0A 81
Exnn (where nn are numbers)
EnCase& Evidence File Format Version 2 (Ex01).
45 6C 66 46 69 6C 65 00
Windows Vista event log file
45 86 00 00 06 00
E†....
Intuit QuickBooks backup file
46 41 58 43 4F 56 45 52
2D 56 45 52
Microsoft Fax Cover Sheet
46 44 42 48 00
Fiasco database definition file
46 45 44 46
(Unknown file type)
46 49 4C 45
NTFS Master File Table (MFT) entry (1,024 bytes)
46 4C 56 01
Flash video file
46 4F 52 4D
Electronic Arts'
46 4F 52 4D 00
Audio Interchange File
DAKX Compressed Audio
Macromedia Shockwave Flash player file (uncompressed). See
46 72 6F 6D 20 20 20 or
46 72 6F 6D 20 3F 3F 3F or
46 72 6F 6D 3A 20
A commmon file extension for e-mail files. Signatures shown here
are for Netscape, Eudora, and a generic signature, respectively.
EML is also used by Outlook Express and QuickMail.
TS, TSA, TSV
file. (This is not a lot to go on, but MPEG-2 Part 1
Transport (MP2T) files are reportedly broken into 188-byte packets and the
0x47 byte is the sync byte, so should repeat every 188 bytes in the file.)
47 46 31 50 41 54 43 48
Advanced Gravis Ultrasound patch file
47 49 46 38 37 61 or
47 49 46 38 39 61
Graphics interchange format file
Trailer: 00 3B (.;)
47 50 41 54
GIMP (GNU Image Manipulation Program) pattern file
Show Partner graphics file (not confirmed)
47 65 6E 65 74 65 63 20
4F 6D 6E 69 63 61 73 74
Genetec video archive
48 45 41 44 45 52 20 52
45 43 4F 52 44 2A 2A 2A
SAS Transport dataset file format
48 48 47 42 31
Harvard Graphics presentation file
Tagged Image File Format file
MPEG-1 Audio Layer 3 (MP3) audio file
49 44 33 03 00 00 00
Sprint Music Store audio file (for mobile devices)
49 49 1A 00 00 00 48 45
41 50 43 43 44 52 02 00
49 49 2A 00
Tagged Image File Format file (little
endian, i.e., LSB Intel)
49 49 2A 00 10 00 00 00
Canon digital camera RAW file ( | )
49 4D 4D 4D 15 00 00 00
Windows 7 thumbcache_idx.db file
49 53 63 28
Install Shield v5.x or 6.x compressed file
49 54 4F 4C 49 54 4C 53
Microsoft Reader eBook file
49 54 53 46
Microsoft Compiled HTML Help File
49 6E 6E 6F 20 53 65 74
75 70 20 55 6E 69 6E 73
74 61 6C 6C 20 4C 6F 67
20 28 62 29
Inno Setup Uninstall Log file
49 6E 74 65 72 40 63 74
69 76 65 20 50 61 67 65
Inter@ctive Pager Backup (BlackBerry) backup file
4A 41 52 43 53 00
JARCS compressed archive
4A 47 03 0E or
4A 47 04 0E
AOL ART file
For 0x4A-47-03-0E: D0 CB 00 00 (ÐË..)
For 0x4A-47-04-0E: CF C7 CB (ÏÇË)
VMware 4 Virtual Disk (portion of a split disk) file
4B 44 4D 56
VMware 4 Virtual Disk (monolitic disk) file
4B 47 42 5F 61 72 63 68
KGB archive
4B 49 00 00
Windows 9x printer spool file
4B 57 41 4A 88 F0 27 D1
KWAJˆð'Ñ
KWAJ file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
This command compresses a single file, replacing the last character in the file name
with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
FOO.BA$. (See the
page for more information.)
4C 00 00 00 01 14 02 00
. See also
relocatable
object code file for an Intel 386 or later/compatible processors
Tajima embroidery sticj image file
4C 49 53 54
Electronic Arts'
4C 4E 02 00
Windows Help index file
Windows Help file.
4C 56 46 09 0D 0A FF 00
LVF...ÿ.
Enn (where nn are numbers)
Logical File Evidence Format (EWF-L01) as used in later versions of
EnCase evidence files. See the .
4D 2D 57 20 50 6F 63 6B
65 74 20 44 69 63 74 69
Merriam-Webster Pocket Dictionary file
4D 41 52 31 00
Mozilla archive
4D 41 52 43
Microsoft/MSN MARC archive
4D 41 72 30 00
MAr compressed archive
4D 43 57 20 54 65 63 68
6E 6F 67 6F 6C 69 65 73
TargetExpress target file
4D 44 4D 50 93 A7
MDMPҤ
Windows heap dump file
Windows minidump file
4D 49 4C 45 53
Milestones v1.0 project management and scheduling software
(Also see "MV2C" and "MV214" signatures)
4D 4C 53 57
Skype localization data file
4D 4D 00 2A
Tagged Image File Format file (big
endian, i.e., LSB Motorola)
4D 4D 00 2B
BigTIFF Tagged Image File Format files >4 GB
4D 4D 4D 44 00 00
Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
for multimedia files that can be played on hand-held devices.
4D 52 56 4E
VMware BIOS (non-volatile RAM) state file.
4D 53 43 46
Microsoft cabinet file
Powerpoint Packaged Presentation
Microsoft Access Snapshot Viewer file
4D 53 46 54 02 00 01 00
OLE, SPSS, or Visual C++ type library file
4D 53 57 49 4D
Microsoft Windows Imaging Format file
4D 53 5F 56 4F 49 43 45
Sony Compressed Voice File
Sony Memory Stick Compressed Voice file
4D 54 68 64
Musical Instrument Digital Interface (MIDI) sound file
Yamaha Piano sound file
CD Stomper Pro label file
4D 56 32 31 34
Milestones v2.1b project management and scheduling software
(Also see "MILES" and "MV2C" signatures)
4D 56 32 43
Milestones v2.1a project management and scheduling software
(Also see "MILES" and "MV214" signatures)
COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS
Windows/DOS executable file
page for the structure of an EXE file,
with coverage of NE, TLINK, PE, self-extracting archives, and more.)
Note: MZ are the initals of Mark Zbikowski, designer of the DOS executable file format.
MS audio compression manager driver
Library cache file
Control panel application
ActiveX or OLE Custom Control
OLE object library
Screen saver
VisualBASIC application
Windows virtual device drivers
4D 5A 90 00 03 00 00 00
Acrobat plug-in
DirectShow filter
Audition graphic filter file (Adobe)
4D 5A 90 00 03 00 00 00
04 00 00 00 FF FF
....ÿÿ
ZoneAlam data file
4D 69 63 72 6F 73 6F 66
74 20 43 2F 43 2B 2B 20
Microsoft C++ debugging symbols file
4D 69 63 72 6F 73 6F 66
74 20 56 69 73 75 61 6C
20 53 74 75 64 69 6F 20
53 6F 6C 75 74 69 6F 6E
20 46 69 6C 65
Visual Studio .NET Solution file
[84 (0x54) byte offset]
4D 69 63 72 6F 73 6F 66
74 20 57 69 6E 64 6F 77
73 20 4D 65 64 69 61 20
50 6C 61 79 65 72 20 2D
[84 (0x54) byte offset]
Windows Media Player playlist
4D 73 52 63 66
VMapSource GPS Waypoint Database
4E 41 56 54 52 41 46 46
TomTom traffic data file
4E 42 2A 00
MS Windows journal file
4E 45 53 4D 1A 01
NES Sound file
4E 49 54 46 30
National Imagery Transmission Format (NITF) file
4E 61 6D 65 3A 20
Agent newsreader character map file
4F 50 43 4C 44 41 54
attachment
1Password 4 Cloud Keychain encrypted attachment
4F 50 4C 44 61 74 61 62
61 73 65 46 69 6C 65
Psion Series 3 Database file
4F 67 67 53 00 02 00 00
00 00 00 00 00 00
OGA, OGG, OGV, OGX
Ogg Vorbis Codec compressed Multimedia file
Visio/DisplayWrite 4 text file (unconfirmed)
50 00 00 00 20 00 00 00
Quicken QuickFinder Information File
Portable Graymap Graphic
50 41 43 4B
Quake archive file
50 41 47 45 44 55 36 34
Windows 64-bit memory dump
50 41 47 45 44 55 4D 50
Windows memory dump
PAX password protected bitmap
50 45 53 54
PestPatrol data/scan strings
50 47 50 64 4D 41 49 4E
PGP disk image
50 49 43 54 00 08
ADEX Corp. ChromaGraph Graphics Card Bitmap Graphic file
50 4B 03 04
PKZIP archive file ( | )
Trailer: filename 50 4B 17 characters 00 00 00
Trailer: (filename PK 17 characters ...)
Note: PK are the initals of Phil Katz, co-creator of the ZIP file format and author of PKZIP.
Apple Mac OS X Dashboard Widget, Aston Shell theme, Oolite eXpansion Pack,
Opera Widget, Pivot Style Template, Rockbox Theme package, Simple Machines
Forums theme, SubEthaEdit Mode, Trillian zipped skin, Virtual Skipper skin
J compressed file package for classes and data
Google Earth saved working session file
KWord document
ODT, ODP, OTT
OpenDocument text document, presentation, and text document template, respectively.
SXC, SXD, SXI, SXW
OpenOffice spreadsheet (Calc), drawing (Draw), presentation (Impress),
and word processing (Writer) files, respectively.
StarOffice spreadsheet
Windows Media compressed skin file
Mozilla Browser Archive
XML paper specification file
eXact Packager Models
50 4B 03 04 0A 00 02 00
Open Publication Structure eBook file. (Should also include the string:
mimetypeapplication/epub+zip)
50 4B 03 04 14 00 01 00
63 00 00 00 00 00
ZLock Pro encrypted ZIP
50 4B 03 04 14 00 06 00
DOCX, PPTX, XLSX
Microsoft Office Open XML Format (OOXML) Document
NOTE: There is no subheader for MS OOXML files as there is with
DOC, PPT, and XLS files. To better understand the format of these files,
rename any OOXML file to have a .ZIP extension and then unZIP
look at the resultant file named [Content_Types].xml to see the content
types. In particular, look for the &Override PartName= tag, where you
will find word, ppt, or xl, respectively.
Trailer: Look for 50 4B 05 06 (PK..) followed by 18 additional bytes
at the end of the file.
50 4B 03 04 14 00 08 0008 00
Java archive
50 4B 05 06
50 4B 07 08
PKZIP empty and multivolume archive file, respectively
[30 (0x1E) byte offset]
50 4B 4C 49 54 45
[30 (0x1E) byte offset]
PKLITE compressed ZIP archive (see also PKZIP)
[526 (0x20E) byte offset]
50 4B 53 70 58
[526 (0x20E) byte offset]
PKSFX self-extracting executable compressed file (see also PKZIP)
50 4D 43 43
Windows Program Manager group file
50 4E 43 49 55 4E 44 4F
Norton Disk Doctor undo file
50 4D 4F 43 43 4D 4F 43
Microsoft& Windows& User State Migration Tool (USMT).
applies to Windows XP and Windows Vista&, and
is for Windows 7.
50 55 46 58
encrypted archive
[92 (0x5C) byte offset]
51 45 4C 20
[92 (0x5C) byte offset]
Quicken data file
51 46 49 FB
QEMU Qcow Disk Image
51 57 20 56 65 72 2E 20
Quicken data file
[512 (0x200) byte offset]
52 00 6F 00 6F 00 74 00
20 00 45 00 6E 00 74 00
72 00 79 00
[512 (0x200) byte offset]
Outlook/Exchange message subheader (MS Office)
52 41 5A 41 54 44 42 31
Shareaza (Windows P2P client) thumbnail
52 45 47 45 44 49 54
Windows NT Registry and Registry Undo files
52 45 56 4E 55 4D 3A 2C
Antenna data file
52 49 46 46
Windows animated cursor
Corel Presentation Exchange (Corel 10 CMX) Metafile
CorelDraw document
Video CD MPEG or MPEG1 movie file
Micrografx Designer v4 graphic file
4X Movie video
52 49 46 46 xx xx xx xx
41 56 49 20 4C 49 53 54
Resource Interchange File Format -- , where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
43 44 44 41 66 6D 74 20
Resource Interchange File Format -- Compact Disc Digital
Audio (CD-DA) file, where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
51 4C 43 4D 66 6D 74 20
Resource Interchange File Format -- Qualcomm
PureVoice, where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
52 4D 49 44 64 61 74 61
Resource Interchange File Format -- , where xx xx xx xx is the file
size (little endian)
52 49 46 46 xx xx xx xx
57 41 56 45 66 6D 74 20
Resource Interchange File Format -- , where xx xx xx xx is the file size (little endian)
52 49 46 46 xx xx xx xx
57 45 42 50
Google , where xx xx xx xx is the file size
52 54 53 53
Windows NT Netmon capture file
52 61 72 21 1A 07 00
RAR (v4.x) compressed archive file
52 61 72 21 1A 07 01 00
compressed archive file
52 65 74 75 72 6E 2D 50
61 74 68 3A 20
A commmon file header for e-mail files.
[4 byte offset]
53 43 43 41
[4 byte offset]
. The first four bytes indicate the OS:
0x11-00-00-00 = XP, 0x17-00-00-00 = Vista/Win7,
and 0x1A-00-00-00 = Win8.1 (and probably Win8, as well).
53 43 48 6C
Need for Speed: Underground Audio file
53 43 4D 49
Img Software Set Bitmap
53 44 50 58
Society of Motion Picture and Television Engineers (SMPTE)
Digital Picture Exchange (DPX) image file (big endian)
53 48 4F 57
Harvard Graphics DOS Ver. 2/x Presentation file
53 49 45 54 52 4F 4E 49
43 53 20 58 52 44 20 53
Sietronics CPI XRD document
53 49 4D 50 4C 45 20 20
3D 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 54
53 49 54 21 00
StuffIt compressed archive
53 4D 41 52 54 44 52 57
SmartDraw Drawing file
53 50 46 49 00
StorageCraft ShadownProtect backup file
53 50 56 42
MultiBit Bitcoin blockchain file
53 51 4C 4F 43 4F 4E 56
48 44 00 00 31 2E 30 00
DB2 conversion file
53 51 4C 69 74 65 20 66
6F 72 6D 61 74 20 33 00
SQLite database file
53 5A 20 88 F0 27 33 D1
SZ ˆð'3Ñ
QBASIC SZDD file header variant. (See the SZDD or KWAJ format entries
for additional information.)
53 5A 44 44 88 F0 27 33
SZDDˆð'3
SZDD file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
This command compresses a single file, replacing the last character in the file name
with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
FOO.BA$. (See the
page for more information.)
53 6D 62 6C
(Unconfirmed file type. Likely type is Harvard Graphics
Version 2.x graphic symbol or Windows SDK graphic symbol)
53 74 75 66 66 49 74 20
28 63 29 31 39 39 37 2D
StuffIt compressed archive
53 75 70 65 72 43 61 6C
SuperCalc worksheet
54 48 50 00
54 68 69 73 20 69 73 20
UNIX GNU Info Reader File
55 43 45 58
Unicode extensions
55 46 41 C6 D2 C1
UFAÆÒÁ
UFA compressed archive
55 46 4F 4F 72 62 69 74
UFO Capture v2 map file
56 43 50 43 48 30
Visual C PreCompiled header file
56 45 52 53 49 4F 4E 20
Visual Basic User-defined Control file
56 65 72 73 69 6F 6E 20
MapInfo Interchange Format file
57 4D 4D 50
Walkman MP3 container file
57 53 32 30 30 30
WordStar for Windows Ver. 2 document
[29,152 (0x71E0) byte offset]
57 69 6E 5A 69 70
[29,152 (0x71E0) byte offset]
WinZip compressed archive
57 6F 72 64 50 72 6F
Lotus WordPro document.
A commmon file extension for e-mail files. This variant is
for Exchange.
58 43 50 00
Cinco NetXRay, Network General Sniffer, and
Network Associates Sniffer capture file
58 50 43 4F 4D 0A 54 79
70 65 4C 69 62
XPCOM type libraries for the XPIDL compiler
58 50 44 53
Society of Motion Picture and Television Engineers (SMPTE)
Digital Picture Exchange (DPX) image file (little endian)
MS Publisher border
5A 4F 4F 20
ZOO compressed archive
Macromedia Shockwave Flash player file (LZMA compressed, SWF 13 and later).
5B 47 65 6E 65 72 61 6C
5D 0D 0A 44 69 73 70 6C
61 79 20 4E 61 6D 65 3D
3C 44 69 73 70 6C 61 79
4E 61 6D 65
MS Exchange 2007 extended configuration file
5B 4D 53 56 43
Microsoft Visual C++ Workbench Information File
5B 50 68 6F 6E 65 5D
Dial-up networking file
5B 56 45 52 5D or
5B 76 65 72 5D or
Lotus AMI Pro document
5B 56 4D 44 5D or
VocalTec VoIP media file
[2 byte offset]
5B 56 65 72 73 69 6F 6E
[2 byte offset]
(Unknown file type)
5B 57 69 6E 64 6F 77 73
20 4C 61 74 69 6E 20
Microsoft Code Page Translation file
5B 66 6C 74 73 69 6D 2E
Flight Simulator Aircraft Configuration file
5B 70 6C 61 79 6C 69 73
WinAmp Playlist file
5D FC C8 00
]üÈ.
Husqvarna Designer I Embroidery Machine file
5F 27 A8 89
_'¨‰
Jar archive
5F 43 41 53 45 5F
EnCase case file (and backup)
Compressed archive file
62 65 67 69 6E
UUencoded files start with a string:
& begin mode path
where mode is the set of permissions as used in
Linux/Unix and path is the name given to the decoded
file. (See this
page for more information.)
62 65 67 69 6E 2D 62 61
73 65 36 34
UUencoded BASE64 file
Trailer: 0A 3D 3D 3D 3D 0A (.====.)
62 70 6C 69 73 74
Binary property list (plist)
(NOTE: Next two bytes are the version number, currently
0x30-30, or "00")
63 61 66 66
63 6F 6E 65 63 74 69 78
Virtual PC Virtual HD image
63 75 73 68 00 00 00 02
Photoshop Custom Shape
64 00 00 00
Intel PROset/Wireless Profile
64 65 78 0A
Dalvik executable file (Android)
64 6E 73 2E
Audacity audio file
64 73 77 66 69 6C 65
Microsoft Visual Studio workspace file
66 49 00 00
Windows NT printer spool file
66 4C 61 43 00 00 00 22
Free Lossless Audio Codec file
[4 byte offset]
66 74 79 70 33 67 70 35
[4 byte offset]
MPEG-4 video files
[4 byte offset]
66 74 79 70 4D 34 41 20
[4 byte offset]
Apple Lossless Audio Codec file
[4 byte offset]
66 74 79 70 4D 53 4E 56
[4 byte offset]
MPEG-4 video file
[4 byte offset]
66 74 79 70 69 73 6F 6D
[4 byte offset]
ISO Base Media file (MPEG-4) v1
[4 byte offset]
66 74 79 70 6D 70 34 32
[4 byte offset]
MPEG-4 video|QuickTime file
[4 byte offset]
66 74 79 70 71 74 20 20
[4 byte offset]
QuickTime movie file
67 49 00 00
Windows 2000/XP printer spool file
67 69 6d 70 20 78 63 66
GNU Image Manipulation Program (GIMP) eXperimental Computing Facility (XCF)
image file
68 49 00 00
Windows Server 2003 printer spool file
6C 33 33 6C
Skype user data file (profile and contacts)
[4 byte offset]
6D 6F 6F 76
[4 byte offset]
QuickTime movie file
.MOV files have a complicated file signature. The string "moov" is the most common but I have also seen:
& 0x66-72-65-65 & free
& 0x6D-64-61-74 & mdat
& 0x77-69-64-65 & wide
And the following have been reported to me:
& 0x70-6E-6F-74 & pnot
& 0x73-6B-69-70 & skip
Furthermore, if you look at byte position xxxxxxxx+4 (where xxxxxxxx is bytes 0-3 of the header), you
will find one (or more!) of th the string "free" seems to be the most common. For
more information, see the
page. (Thanks to D. Wright for getting me started on this!)
6D 73 46 69 6C 74 65 72
4C 69 73 74
Internet Explorer v11 Tracking Protection List file
6D 75 6C 74 69 42 69 74
2E 69 6E 66 6F
MultiBit Bitcoin wallet information file
Short Message Service (SMS), or text, message stored on a
Subscriber Identification Module (SIM).
6F 70 64 61 74 61 30 31
1Password 4 Cloud Keychain encrypted data
72 65 67 66
Windows NT registry hive file
72 69 66 66
Sonic Foundry Acid Music File (Sony)
72 74 73 70 3A 2F 2F
RealMedia metafile
73 6C 68 21 or
73 6C 68 2E
Allegro Generic Packfile Data file (0x21 = compressed,
0x2E = uncompressed)
PalmOS SuperMemo file
73 6F 6C 69 64
for 3D printing.
73 72 63 64 6F 63 69 64
CALS raster bitmap file
73 7A 65 7A
PowerBASIC Debugger Symbols file
[60 (0x3C) byte offset]
74 42 4D 50 4B 6E 57 72
[60 (0x3C) byte offset]
PathWay Map file, used with GPS devices
[257 (0x101) byte offset]
75 73 74 61 72
[257 (0x101) byte offset]
Tape Archive file ()
76 2F 31 01
OpenEXR bitmap image format
76 32 30 30 33 2E 31 30
0D 0A 30 0D 0A
Qimage filter
78 01 73 0D 62 62 60
Mac OS X Disk Copy Disk Image file
78 61 72 21
7A 62 65 78
ZoomBrowser Image Index file ()
7B 0D 0A 6F 20
Windows application log
7B 5C 70 77 69
Microsoft Windows Mobile personal note file
7B 5C 72 74 66 31
Rich text format word processing file
Trailer: 5C 70 61 72 20 7D 7D (\par }})
7C 4B C3 74 E1 C8 53 A4
79 B9 01 1D FC 4F DD 13
|KÃtáÈS¤
y¹..üOÝ.
Huskygram, Poem, or Singer embroidery design file
7E 42 4B 00
Corel Paint Shop Pro image file
7E 74 2C 01 50 70 02 4D
52 01 00 00 00 08 00 00
00 01 00 00 31 00 00 00
31 00 00 00 43 01 FF 00
01 00 08 00 01 00 00 00
7e 74 2c 01
1...C.ÿ.
Reportedly a proprietary recording system, possibly a
Digital Watchdog DW-TP-500G unit.
7F 45 4C 46
Relocatable object code
80 00 00 20 03 12 04
Dreamcast audio file
80 2A 5F D7
Kodak Cineon image file
81 32 84 C1 85 05 D0 11
B2 90 00 AA 00 3C F6 76
.2„Á….Ð.
²..ª.&öv
Outlook Express address book (Win95)
.Í«
WordPerfect text file
†Ý{lower_case letter}
Possibly, maybe, might be a fragment of an Ethernet frame carrying
an IPv6 packet. See .
89 50 4E 47 0D 0A 1A 0A
‰PNG....
Trailer: 49 45 4E 44 AE 42 60 82 (IEND®B`‚...)
8A 01 09 00 00 00 E1 08
00 00 99 19
Š.....á.
MS Answer Wizard file
91 33 48 46
Hamarsoft HAP 3.x compressed archive
PGP secret keyring file
97 4A 42 32 0D 0A 1A 0A
—JB2....
JBOG2 image file.
Trailer: 03 33 00 01 00 00 00 00 (.3......)
GNU Privacy Guard (GPG) public keyring
PGP public keyring file
9C CB CB 8D 13 75 D2 11
91 58 00 C0 4F 79 56 A4
œËË..UÒ.
‘X.ÀOyV¤
Outlook address file
[512 (0x200) byte offset]
A0 46 1D F0
[512 (0x200) byte offset]
 F.ð
PowerPoint presentation subheader (MS Office)
A1 B2 C3 D4
¡²ÃÔ
tcpdump (libpcap) capture file (Linux/Unix)
A1 B2 CD 34
¡²Í4
Extended tcpdump (libpcap) capture file (Linux/Unix)
A9 0D 00 00 00 00 00 00
©.......
Access Data FTK evidence file
AC 9E BD 8F 00 00
¬.½...
Quicken data file
’
Java serialization data (see )
AC ED 00 05 73 72 00 12
62 67 62 6C 69 74 7A 2E
’..sr..
BGBlitz (professional Backgammon software) position database file
B0 4D 46 43
Windows 95 password file
B1 68 DE 3A
±hÞ:
Graphics Multipage PCX bitmap file
B4 6E 68 44
Acronis True Image file
B5 A2 B0 B3 B3 B0 A5 B5
µ¢°³³°¥µ
Windows calendar file
BE 00 00 00 AB 00 00 00
00 00 00 00 00
¾...«...
MS Write file
BE BA FE CA 0F 50 61 6C
6D 53 47 20 44 61 74 61
¾ºþÊ.Pal
Palm Desktop DateBook file
C3 AB CD AB
ëͫ
MS Agent Character file
C5 D0 D3 C6
ÅÐÓÆ
Adobe encapsulated PostScript file
C8 00 79 00
Jeppesen FliteLog file
CA FE BA BE
Êþº¾
Java bytecode file (also used by Apple iOS apps)
CD 20 AA AA 02 00 00 00
Í ªª....
Norton Anti-Virus quarantined virus file
CE CE CE CE
ÎÎÎÎ
CE FA ED FE
Îúíþ
binary file (32-bit, where target system has reverse byte
ordering from host running compiler)
CF 11 E0 A1 B1 1A E1 00
Ï.ࡱ.á.
Perfect Office document
[Note similarity to MS Office header, below]
CF AD 12 FE
Ï­.þ
Outlook Express e-mail folder
CF FA ED FE
Ïúíþ
binary file (64-bit, where target system has reverse byte
ordering from host running compiler)
D0 CF 11 E0 A1 B1 1A E1
ÐÏ.ࡱ.á
, DOT, PPS, , XLA, , WIZ
An Object Linking and Embedding (OLE) Compound File (CF) (i.e., )
file format, known as Compound Binary File format by Microsoft, used by
Microsoft Office 97-2003 applications (Word, Powerpoint, Excel, Wizard).
[See also Excel, Outlook, PowerPoint, and Word "subheaders" at byte offset 512 (0x200).]
There appear to several subheader formats and a dearth of documentation.
There have been reports that there are different subheaders for Windows and Macversions of MS Office but I cannot confirm that.]
Password-protected DOCX, XLSX, and PPTX files also use this signature those filesare saved as OLECF files.
[Note the similarity between D0 CF 11 E0 and the word "docfile"!]
CaseWare Working Papers compressed client file
Access project file
Lotus/IBM Approach 97 file
MSWorks database file
Microsoft Common Console Document
Microsoft Outlook/Exchange Message
Microsoft Installer package
Minitab data file
Developer Studio File Workspace Options file
MS Publisher file
QuickBooks Portable Company File
Revit Project file
Visual Studio Solution User Options file
SPSS output file
Visio file
MSWorks text document
D2 0A 00 00
GN Nettest WinPharoah filter file
AOL history (ARL) and typed URL (AUT) files
D4 C3 B2 A1
Ôò¡
WinDump (winpcap) capture file (Windows)
D7 CD C6 9A
×ÍÆš
Windows graphics metafile
DB A5 2D 00
Û¥-.
Word 2.0 file
ÜÜ
Corel color palette file
Üþ
eFax file format
E3 10 00 01 00 00 00 00
ã.......
Amiga Icon file
E3 82 85 96
ã‚…–
Windows 98 password file
E4 52 5C 7B 8C D8 A7 4D
AE B1 53 78 D0 29 96 D3
äR\{ŒØ§M
®±SxÐ)–Ó
Microsoft OneNote note
Windows executable file
EB 3C 90 2A
GEM Raster file
EB 52 90 2D 46 56 45 2D
ëR.-FVE-
Header of boot sector in BitLocker protected volume (Vista)
EB 58 90 2D 46 56 45 2D
ëX.-FVE-
Header of boot sector in BitLocker protected volume (Windows 7)
[512 (0x200) byte offset]
EC A5 C1 00
[512 (0x200) byte offset]
ì¥Á.
Word document subheader (MS Office)
ED AB EE DB
í«îÛ
RedHat Package Manager file

Byte-order mark (BOM) for 8-bit Unicode Transformation Format
(UTF-8) files.
(See the .)
[At a cluster boundary]
[At a cluster boundary]
ðÿÿ
FAT12 File Allocation Table
[At a cluster boundary]
F8 FF FF FF
[At a cluster boundary]
øÿÿÿ
FAT16 File Allocation Table
[At a cluster boundary]
F8 FF FF 0F FF FF FF 0F
[At a cluster boundary]
øÿÿ.ÿÿÿ.
FAT32 File Allocation Table
[At a cluster boundary]
F8 FF FF 0F FF FF FF FF
[At a cluster boundary]
øÿÿ.ÿÿÿÿ
FAT32 File Allocation Table
F9 BE B4 D9
ù¾´Ù
Bitcoin-Qt blockchain block file
FD 37 7A 58 5A 00
ý7zXZ.
XZ archive file
[512 (0x200) byte offset]
FD FF FF FF 02
[512 (0x200) byte offset]
ýÿÿÿ.
MS Publisher file subheader
[512 (0x200) byte offset]
FD FF FF FF 04
[512 (0x200) byte offset]
ýÿÿÿ.
QuickBooks Portable Company File
Visual Studio Solution User Options subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF nn nn 00 00
[512 (0x200) byte offset]
ýÿÿÿ....
PowerPoint presentation subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF nn 00
[512 (0x200) byte offset]
ýÿÿÿ..
[512 (0x200) byte offset]
FD FF FF FF nn 02
[512 (0x200) byte offset]
ýÿÿÿ..
Excel spreadsheet subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF 20 00 00 00
[512 (0x200) byte offset]
ýÿÿÿ ...
Developer Studio File Workspace Options subheader (MS Office)
Excel spreadsheet subheader (MS Office)
[512 (0x200) byte offset]
FD FF FF FF xx xx xx xx
xx xx xx xx 04 00 00 00
[512 (0x200) byte offset]
ýÿÿÿ....
Thumbs.db subheader (MS Office)
FE ED FA CE
þíúÎ
binary file (32-bit)
FE ED FA CF
þíúÏ
binary file (64-bit)
FE ED FE ED
þíþí
þï
Symantex Ghost image file
þÿ
Byte-order mark (BOM) for 16-bit Unicode Transformation Format/
2-octet Universal Character Set (UTF-16/UCS-2), big-endian files.
(See the .)
Windows executable (SYS) file
FF 00 02 00 04 04 05 54
ÿ......T
Works for Windows spreadsheet file
QuickReport Report file
FF 46 4F 4E 54
ÿFONT
Windows international code page
FF 4B 45 59 42 20 20 20
ÿKEYB
Keyboard driver file
FF 57 50 43
WP, WPD, WPG, WPP, WP5, WP6
WordPerfect text and graphics file
FF D8 FF E0 xx xx 4A 46
ÿØÿà..JF
JFIF, JPE, JPEG, JPG
Trailer: FF D9 (ÿÙ)
FF D8 FF E1 xx xx 45 78
ÿØÿá..Ex
Digital camera JPG using
Trailer: FF D9 (ÿÙ)
(P. Alvarez, IJDE, 2(3), Winter 2004) and
FF D8 FF E8 xx xx 53 50
49 46 46 00
ÿØÿè..SP
Trailer: FF D9 (ÿÙ)
NOTES on JPEG file headers: It appears that one can safely say that all JPEG files start with the three hex digits 0xFF-D8-FF.
The fourth digit is also indicative of JPEG content. Various options include:
0xFF-D8-FF-DB — Samsung D807 JPEG file.
0xFF-D8-FF-E0 — Shown above. .
0xFF-D8-FF-E1 — Shown above. Standard JPEG/Exif file.
0xFF-D8-FF-E2 — Canon EOS-1D JPEG file.
0xFF-D8-FF-E3 — Samsung D500 JPEG file.
0xFF-D8-FF-E8 — Shown above. .
MPEG, MPG, MP3
MPEG audio file frame
ÿñ
MPEG-4 Advanced Audio Coding (AAC) Low Complexity (LC) audio file
ÿù
MPEG-2 Advanced Audio Coding (AAC) Low Complexity (LC) audio file
ÿþ
Windows Registry file
Byte-order mark (BOM) for 16-bit Unicode Transformation Format/
2-octet Universal Character Set (UTF-16/UCS-2), little-endian files.
(See the .)
FF FE 00 00
ÿþ..
Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), little-endian files.
(See the .)
FF FE 23 00 6C 00 69 00
6E 00 65 00 20 00 31 00
ÿþ#.l.i.
Windows MSinfo file
FF FF FF FF
ÿÿÿÿ
DOS system driver
, author of the
(primarily for the "subheaders" for many of the file types here), and the people at
for their permission to incorporate their lists of file signatures.
Finally, Dr. Nicole Beebe from The University of Texas at San Antonio posted samples of more than 32 file types at the Digital Corpora, which I used for verification and additional signatures. These files were used to develop the . The file samples can be downloaded from the
COPYRIGHT NOTICE
All information on this page & , Gary C. Kessler. Permission to use the material here is extended to any of this page's visitors, as long as appropriate attribution is provided and the information is not altered in any way without express written permission of the author.}
我要回帖
更多关于 dnf蓝拳刺拳猛击 的文章
- ·WWW.59hhh-COM★猛击宏此处★WWW.59hhh-COM★温柔进入★WWW.59hhh-COM
- ·www.998837-com★猛击宏此处★www.998837-com★使劲插入★www.998837-com怎么处理啊？
- ·92xx00-com★用力进入★92xx00-com★嗜血猛击宏这个址★92xx00-com★怎么处理好呢？
- ·WWW.220505-COM〓更新唯一永久地址〓★猛击此处得百万铜钱★WWW.220505-COM
- ·〓更新唯一永久免费地址〓WWW.YYY17-COM★猛击此处得百万铜钱★WWW.YYY17-COM
- ·%%WwW.63ks_CoM %%>嫩肉禁护★WwW.63ks_CoM 〓战士猛击宏这里〓WwW.63ks_CoM
- ·%%WwW.57VVV_CoM%%>嫩肉禁护★WwW.57VVV_CoM〓战士猛击宏这里〓WwW.57VVV_CoM
更多推荐
- ·美捷登视频号的直播平台抽奖合法吗抽奖是真的吗？朋友圈海报看到的，他们公司每次直播平台抽奖合法吗真送这么多东西吗？
- ·这个找一本小说名字忘记了叫什么？
- ·西瓜娱乐里面有很多软件的永不失联最新2022破解版上线了？WorldTalk网友安娜贝尔：等了好久！
- ·2000的预算选卡普马的哪款入门吉他卡马好还是雅马哈好？
- ·地劫在子女宫代表什么缘 说坤位受阻什么意思？
- ·爱帮团北京退款的话是多少 爱帮团北京怎么申请退款mfv
- ·lcx爱你永远远系几远?
- ·这句的一点疑问Only like that can you make a genuine achievement的动词
- ·棋牌里面有什么游戏好玩的呢？通知存款是什么意思个情况？
- ·260团券可以260团怎么申请退款款吗??260团如何260团怎么申请退款款??
- ·gf生活中真是少女性感，熟女开放教室啊[64P]eshzg
- ·,x和老公爱爱他快进来时我们俩都疼是怎么回事f,.ajw
- ·有人了解太阳能技术吗?比如太阳能灯价格?说的越详细越好
- ·色既是空-最新地址leg!*-色既是空本月更新~~~~~leg
- ·高清短片高速短片-最新地址svn!*-高清短片高速短片本月更新~~~~~svn
- ·我和男朋友在安全期发生关系,他带套了,我快来月经安全期了,今天肚子很疼,但没来,怎么回事
- ·qq空间日志最近访客怎么看最近访客？
- ·%%WwW.57VVV_CoM%%>嫩肉禁护★WwW.57VVV_CoM〓战士猛击宏这里〓WwW.57VVV_CoM
- ·网上购买电脑组件好吗？
- ·高速无需视频播放器器-最新地址tfg!*-高速无需视频播放器器本月更新~~~~~tfg
- ·QQ在荆州登陆，从荆州到十堰的火车网监局可以查到QQ在荆州登陆的具体IP么？
- ·澳客足球网竞彩足球
- ·有人知道韦德在和平区有南宁高考补习班班在哪吗？
- ·UN联众国际、un联众平台吧、安全吗？
- ·有滑膜炎的症状，吃啥能好？
- ·博天堂好不好呢?皇家猫粮好不好ROYAL1688比如说是算牌什么的？
- ·关于 螃蟹的责备 的作文的题目知否应是绿肥红瘦什么啊
- ·窝窝团券可以退款吗券怎么退款??窝窝团券可以退款吗券怎么申请退款??
- ·F团账户美团余额怎么提现现________√xel
- ·kj请问帅哥见到我爱漂亮女孩dj会有什么感觉？zxuoz
