FILE SIGNATURES TABLE

16 December 2017

This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I had found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list in 2002. See also Wikipedia's List of file signatures. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net.

This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:

Some other useful information:

If you are using a Linux/Mac OS X/Unix system, you can use the file command to determine the file type based upon the file signature, per the system's magicfile.

And, one last and final item — if you are searching for network traffic in raw binary files (e.g., RAM or unallocated space), see Hints About Looking for Network Packet Fragments.


ACKNOWLEDGEMENTS & COPYRIGHT NOTICE


Hex Signature                ASCII Signature
File Extension              File Description

TGA   Truevision Targa Graphic file
Trailer:
54 52 55 45 56 49 53 49   TRUEVISI
4F 4E 2D 58 46 49 4C 45   ON-XFILE
2E 00                     ..

00   .
PIC   IBM Storyboard bitmap file
MOV   Apple QuickTime movie file
PIF   Windows Program Information File
SEA   Mac Stuffit Self-Extracting Archive
YTR   IRIS OCR data file

00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
  ........
........
XXX   Compucon/Singer embroidery design file

[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
  [11 byte offset]
........
........
........
PDB   Palmpilot Database/Document File

[512 (0x200) byte offset]
00 00 00 00 00 00 00 00
  [512 (0x200) byte offset]
........
RVT   Revit Project File subheader

00 00 00 00 14 00 00 00   ........
TBI   Windows Disk Image file

[8 byte offset]
00 00 00 00 62 31 05 00
09 00 00 00 00 20 00 00
00 09 00 00 00 00 00 00
  [8 byte offset]
....b1..
..... ..
........
DAT   Bitcoin Core wallet.dat file

00 00 00 0C 6A 50 20 20
0D 0A
  ....jP 
..
JP2   Various JPEG-2000 image file formats

00 00 01 00   ....
ICO   Windows icon file
SPL   Windows NT/2000/XP printer spool file

00 00 01 Bx   ....
MPEG, MPG   MPEG video file
Trailer:
00 00 01 B7 (...·)

00 00 01 BA   ....º
MPG, VOB   DVD Video Movie File (video/dvd, video/mpeg) or DVD MPEG2
Trailer:
00 00 01 B9 (...¹)

00 00 02 00   ......
CUR   Windows cursor file
WB2   QuattroPro for Windows Spreadsheet file

00 00 02 00 06 04 06 00
08 00 00 00 00 00
  ........
......
WK1   Lotus 1-2-3 spreadsheet (v1) file

00 00 03 F3   ...ó
n/a   Amiga Hunk executable file

00 00 1A 00 00 10 04 00
00 00 00 00
  ........
....
WK3   Lotus 1-2-3 spreadsheet (v3) file

00 00 1A 00 02 10 04 00
00 00 00 00
  ........
....
WK4, WK5   Lotus 1-2-3 spreadsheet (v4, v5) file

00 00 1A 00 05 10 04   .......
123   Lotus 1-2-3 spreadsheet (v9) file

00 00 49 49 58 50 52 or   ..IIXPR
00 00 4D 4D 58 50 52   ..MMXPR
QXD   Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
the language indicator; 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.

00 00 FE FF   ..þÿ
n/a   Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the Unicode Home Page.)

[6 byte offset]
00 00 FF FF FF FF
  [6 byte offset]
..ÿÿÿÿ
HLP   Windows Help file

00 01 00 00 00   .....
TTF   TrueType font file

00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
61 73 65
  ....MSIS
AM Datab
ase
MNY   Microsoft Money file

00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
20 44 42
  ....Stan
dard ACE
 DB
ACCDB   Microsoft Access 2007 file

00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
20 44 42
  ....Stan
dard Jet
 DB
MDB   Microsoft Access file

00 01 00 08 00 01 00 01
01
  ........
.
IMG   Ventura Publisher/GEM VDI Image Format Bitmap file

00 01 01   ...
FLT   OpenFlight 3D file

00 01 42 41   ..BA
ABA   Palm Address Book Archive file

00 01 42 44   ..BD
DBA   Palm DateBook Archive file

00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00
  ...a....
...Ò....
DB   Netscape Navigator (v4) database file

00 0D BB A0   ..» 
n/a   Mbox table of contents file. (NOTE: The next four bytes
appear to be the number of e-mails in the associated mbox file.)

00 11 AF   ..¯
FLI   FLIC Animation file

00 14 00 00 01 02 xx xx
03
  ........
.
n/a   BIOS details in RAM images

00 1E 84 90 00 00 00 00   ..„.....
SNM   Netscape Communicator (v4) mail folder

00 20 AF 30   . ¯0
TPL   Wii images container

00 5C 41 B1 FF   .\A±ÿ
ENC   Mujahideen Secrets 2 encrypted file

[512 (0x200) byte offset]
00 6E 1E F0
  [512 (0x200) byte offset]
.n.ð
PPT   PowerPoint presentation subheader (MS Office)

00 BF   .¿
SOL   Adobe Flash shared object file (e.g., Flash cookies)

00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01
  .ÿÿÿÿÿÿÿ
ÿÿÿ.....
MDF   Alcohol 120% CD image

01 00 00 00   ....
EMF   Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)

01 00 00 00 01   .....
PIC   Unknown type picture file

01 00 09 00 00 03   ......
WMF   Windows Metadata file (Win 3.x format)

01 00 02 00   ....
ARF   Webex Advanced Recording Format files.

01 00 39 30   ..90
FDB, GDB   Firebird and Interbase database files, respectively. See
IBPhoenix for more information.

01 01 47 19 A4 00 00 00
00 00 00 00
  ..G.#xA4...
....
TBI   The Bat! secure e-mail Message Base Index file

01 0F 00 00   ....
MDF   Microsoft SQL Server 2000 database

01 10   ..
TR1   Novell LANalyzer capture file

01 DA 01 01 00 03   .Ú....
RGB   Silicon Graphics RGB Bitmap

01 FF 02 04 03 02   .ÿ....
DRW   Micrografx vector graphic file

02 64 73 73   .dss
DSS   Digital Speech Standard (Olympus, Grundig, & Phillips)

03   .
DAT   MapInfo Native Data Format
DB3   dBASE III file

03 00 00 00   ....
QPH   Quicken price history file

03 00 00 00 41 50 50 52   ....APPR
ADX   Approach index file

04   .
DB4   dBASE IV data file

04 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00 or
  ........
.... ...
05 00 00 00 xx xx xx xx
xx xx xx xx 20 03 00 00
  ........
.... ...
n/a   INFO2 Windows recycle bin file. NOTE: Bytes 12-13
indicate the size of each INFO2 record; the most common
value is 0x20-03 (0x0320 = 800 bytes).

06 06 ED F5 D8 1D 46 E5
BD 31 EF E7 FE 74 B7 1D
  ..íõØ.Få
½1ïçþt·.
INDD   Adobe InDesign document

06 0E 2B 34 02 05 01 01
0D 01 02 01 01 02
  ..+4....
......
MXF   Material Exchange Format file

07   .
DRW   A common signature and file extension for many drawing
programs.

07 53 4B 46   .SKF
SKF   SkinCrafter skin file

07 64 74 32 64 64 74 64   .dt2ddtd
DTD   DesignTools 2D Design file

08   .
DB   dBASE IV or dBFast configuration file

08 00 45   ..E
n/a   Possibly, maybe, might be a fragment of an Ethernet frame carrying
an IPv4 packet. See Hints About Looking for Network Packet Fragments.

[512 (0x200) byte offset]
09 08 10 00 00 06 05 00
  [512 (0x200) byte offset]
........
XLS   Excel spreadsheet subheader (MS Office)

0A nn 01 01   ....
PCX   ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)

0A 16 6F 72 67 2E 62 69
74 63 6F 69 6E 2E 70 72
  ..org.bi
tcoin.pr
WALLET   MultiBit Bitcoin wallet file

0C ED  
MP   Monochrome Picture TIFF bitmap file (unconfirmed)

0D 44 4F 43   .DOC
DOC   DeskMate Document file

0E 4E 65 72 6F 49 53 4F   .NeroISO
NRI   Nero CD Compilation

0E 57 4B 53   .WKS
WKS   DeskMate Worksheet

[512 (0x200) byte offset]
0F 00 E8 03
  [512 (0x200) byte offset]
..è.
PPT   PowerPoint presentation subheader (MS Office)

10 00 00 00   ....
CL5   Easy CD Creator 5 Layout file

1A 00 00   ...
NTF   Lotus Notes database template

1A 00 00 04 00 00   ......
NSF   Lotus Notes database

1A 0x   ..
ARC   LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)

1A 0B   ..
PAK   Compressed archive file
(often associated with Quake Engine games)

1A 35 01 00   .5..
ETH   GN Nettest WinPharoah capture file

1A 45 DF A3   .Eߣ
MKV   Matroska stream file
WEBM   WebM video file

1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
2E 30 1A
  .RTS COM
PRESSED 
IMAGE V1
.0.
DAT   Runtime Software compressed disk image

1D 7D   .}
WS   WordStar Version 5.0/6.0 document

1F 8B 08   .‹.
GZ, TGZ   GZIP archive file
VLT   VLC Player Skin file

1F 9D   ..
TAR.Z   Compressed tape archive file using standard (Lempel-Ziv-Welch) compression

1F A0  
TAR.Z   Compressed tape archive file using LZH (Lempel-Ziv-Huffman) compression

21   !
BSB   MapInfo Sea Chart

21 12   !.
AIN   AIN Compressed Archive

21 3C 61 72 63 68 3E 0A   !<arch>.
LIB   Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)

21 42 44 4E  

FILE SIGNATURES TABLE的更多相关文章

  1. java.sql.SQLException: Incorrect key file for table 'C:\Windows\TEMP\#sql578_6e2_68d.MYI'; try to repair it

    java.sql.SQLException: Incorrect key file for table 'C:\Windows\TEMP\#sql578_6e2_68d.MYI'; try to re ...

  2. mysqld: Incorrect key file for table

    错误 140624 0:53:42 [ERROR] /usr/libexec/mysqld: Incorrect key file for table './xx/xxx.MYI'; try to r ...

  3. mysql出现“Incorrect key file for table”解决办法

    本文来自: https://www.cnblogs.com/zjoch/archive/2013/08/19/3267131.html 今天mysql突然出现以下错误: mysql> selec ...

  4. Incorrect key file for table错误解决方法

    问题现象: alter table portal_app_xxxx_xxx add devno varchar(64) NOT NULL DEFAULT '' COMMENT '设备机编',add s ...

  5. MySQL表损坏修复【Incorrect key file for table】

    今天机房mysql服务器异常关机,重新启动后报错如下: -- :: [ERROR] /usr/local/mysql/bin/mysqld: Incorrect key file for table ...

  6. MyISAM引擎表出现“Error 'Incorrect key file for table”

    mysql主从复制中的从库突然出现了警报,sql_thread停止了,show slave status\G;查看 mysql> show slave status\G ; . row **** ...

  7. mysql中大数据表alter增加字段报错:"1034 Incorrect key file for table 'table_name'; try to repair it"

    mysql中大数据表alter增加字段报错:"1034 Incorrect key file for table 'table_name'; try to repair it" 现 ...

  8. 数据表损坏:Incorrect key file for table

    最近做项目过程中,调用数据库内容,老是出现一些类似于数据表损坏的提示信息(Incorrect key file for table edison_category),查询不到数据,很是恼火,后来冷静下 ...

  9. mysql错误(Incorrect key file for table)

    Incorrect key file for table 'C:\Windows\TEMP\#sql578_6e2_68d.MYI'; try to repair it mysql错误:mysql需要 ...

随机推荐

  1. Mysql 系统表

    Information_schema: 1. tables 提供表信息: 表所属数据库,表名,表类型,行数,最大自增数等等.

  2. 对于Spring中注入对象失败的问题

    1.今天进行了一段代码,经过检查发现config配置文件没问题,注入注解也编写正确,但是RedisTemplate就是会抛出空指针异常. 进过一系列检查发现,其在用户使用该类的时候采用的是new方式创 ...

  3. 【CF263D】Cycle in Graph

    题目大意:给定一个 N 个点,M 条边的无向图,保证图中每个节点的度数大于等于 K,求图中一条长度至少大于 K 的简单路径,输出长度和路径包含的点. 题解:依旧采用记录父节点的方式进行找环,不过需要记 ...

  4. c++ stl sort

    两者相等时,必须为false. 满足拟序. 群里大佬666.

  5. 第二十二节,TensorFlow中的图片分类模型库slim的使用、数据集处理

    Google在TensorFlow1.0,之后推出了一个叫slim的库,TF-slim是TensorFlow的一个新的轻量级的高级API接口.这个模块是在16年新推出的,其主要目的是来做所谓的“代码瘦 ...

  6. VMware for mac inside error solutions

    Terminal 下执行 sudo xattr -r -d com.apple.quarantine /Applications/VMware\ Fusion.app 之后就能正常打开镜像安装虚拟机了 ...

  7. windows server 2012 流媒体服务器搭建(直播与点播)

    IIS Live Smooth Streaming(实时平滑流式处理)是微软下一代流媒体解决方案.该技术是在IIS web中集成媒体传输平台IIS media services,实现利用标准 HTTP ...

  8. Druid数据源配置

    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource" init-met ...

  9. 访问内网(https,udp)

    安装teamview 客户端. 安装vpn驱动(这里的VPN应该是A主机与B客户端分别连接上了teamview的服务器,但是本身不是局域 网,所以不能直接访问A的局域网的其他主机) 主机端A,安装主机 ...

  10. 【.NET】SqlDateTime 溢出。必须介于 1/1/1753 12:00:00 AM 和 12/31/9999 11:59:59 PM之间

    #背景 向sqlserver数据库中一个datetime字段插入DateTime.MinValue时, 出现问题: SqlDateTime 溢出.必须介于 1/1/1753 12:00:00 AM 和 ...