Magic file type

The length used for matching is that of the string argument in the magic file. The special test x always evaluates to true. If the string contains a printf 3 format specification, the value from the file with any specified masking performed is printed using the message as the format string. An optional strength can be supplied on a separate line which refers to the current magic description using the following format:! This constant is applied using the specified operand to the currently computed default magic strength.

Some file formats contain additional information which is to be printed along with the file type or need additional tests to determine the true file type. That means that the number after the parenthesis is used as an offset in the file. The value at that offset is read, and is used again as an offset in the file.

Indirect offsets are of the form: x [. The value of x is used as an offset in the file. A byte, id3 length, short or long is read at that offset depending on the [bislBISLm] type specifier. The capitalized types interpret the number as a big endian value, whereas the small letter versions interpret the number as a little endian value; the m type interprets the number as a middle endian PDP value.

To that number the value of y is added and the result is used as an offset in the file. The default type if one is not specified is long. Note that this additional indirect offset is always relative to the start of the main indirect offset. This table of file signatures aka "magic numbers" is a continuing work-in-progress. I had found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T.

Jenkinson Springer, ; that was my inspiration to start this list in See also Wikipedia's List of file signatures. Comments, additions, and queries can be sent to Gary Kessler at gck garykessler. This list is not exhaustive although I add new files as I find them or someone contributes signatures. Interpret the table as a one-way function: the magic number generally indicates the file type whereas the file type does not always have the given magic number.

If you want to know to what a particular file extension refers, check out some of these sites:. The File Signatures Web site searches a database based upon file extension or file signature. Tim Coakley's Filesig. Additional details on audio and video file formats can be found at the Sustainability of Digital Formats Planning for Library of Congress Collections site.

I thank them and apologize if I have missed anyone. I would like to give particular thanks to Danny Mares of Mares and Company , author of the MaresWare Suite primarily for the "subheaders" for many of the file types here , and the people at X-Ways Forensics for their permission to incorporate their lists of file signatures.

Finally, Dr. Nicole Beebe from The University of Texas at San Antonio posted samples of more than 32 file types at the Digital Corpora, which I used for verification and additional signatures. These files were used to develop the Sceadan File Type Classifier. The file samples can be downloaded from the Digital Corpora website. Permission to use the material here is extended to any of this page's visitors, as long as appropriate attribution is provided and the information is not altered in any way without express written permission of the author.

Amiga Hunk executable file. See the Unicode Home Page. Mbox table of contents file. NOTE: The next four bytes appear to be the number of e-mails in the associated mbox file.

Firebird and Interbase database files, respectively. See IBPhoenix for more information. The Bat! INFO2 Windows recycle bin file. Material Exchange Format file. Possibly, maybe, might be a fragment of an Ethernet frame carrying an IPv4 packet. Microsoft Outlook Personal Folder File. See RFC Audio compression format developed by Skype; also used by other applications. This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.

Read More. Team NetSPI. Recent Posts. Technical Blog Cloud Penetration Testing. Need a Quote? Common Questions.