List of file signatures

List of file signatures

This is a list of file signatures, data used to identify or verify the content of a file. Such signatures are also known as magic numbers and are further explained in the Magic number (programming) article. Many binary file formats are not intended to be read as text. If such a file is accidentally viewed as a text file, its contents will be unintelligible. However, sometimes the file signature can be recognizable when interpreted as text. The column ISO 8859-1 shows how the file signature appears when interpreted as text in the common ISO 8859-1 encoding.
Hex signature 00 . ISO 8859-1 0 Offset File extension PIC PIF SEA YTR PDB Description IBM Storyboard bitmap file Windows Program Information File Mac Stuffit Self-Extracting Archive IRIS OCR data file PalmPilot Database/Document File

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BE BA FE CA 00 01 42 44 00 01 44 54 00 01 00 00 00 00 01 00 00 00 00 nn 66 74 79 70 33 67 70

........ ........ ........ ... ... ... ... .... ....ftyp 3gp

11

0 0 0 0 0 0

DBA DBA TDA ... ico 3GG, 3GP, 3G2

Palm Desktop Calendar Archive Palm Desktop To Do Archive Palm Desktop Calendar Archive Palm Desktop Data File (Access format) [1] Computer icon encoded in ICO file format 3rd Generation Partnership Project 3GPP (nn=0x14) and 3GPP2 (nn=0x20) multimedia files MPEG-4 video files

00 00 00 nn 66 74 79 70 33 67 70 35 1F 9D

....ftyp 3gp5 ..

MP4

z, tar.z

compressed file (often tar zip) using Lempel-Ziv-Welch algorithm Compressed file (often tar zip) using LZH algorithm Image file encoded in the Graphics [2] Interchange Format (GIF) Tagged Image File Format

1F A0

..

z, tar.z

47 49 46 38 37 61 47 49 46 38 39 61 49 49 2A 00 4D 4D 00 2A FF D8 FF 4D 5A

GIF87a GIF89a

gif

II*. MM* MZ

tif, tiff

0 0

jpg, jpeg exe

JPEG DOS MZ executable file format and its descendants (including NE and PE) zip file format and formats based on it, such as JAR, ODF, OOXML

50 4B 03 04, 50 4B 05 06 (empty archive) or 50 4B 07 08 (spanned archive) 52 61 72 21 1A 07 00 52 61 72 21 1A 07 01 00 7F 45 4C 46

PK..

zip, jar, odt, ods, odp, docx, xlsx, pptx, apk rar rar

Rar!... Rar!.... .ELF

0 0 0

RAR archive version 1.50 onwards RAR archive version 5.0 onwards Executable and Linkable Format

List of file signatures

2
.PNG.... 0 png

89 50 4E 47 0D 0A 1A 0A

Image encoded in the Portable Network [3] Graphics format Java class file, Mach-O Fat Binary UTF-8 encoded Unicode byte order mark, commonly seen in text files. Mach-O binary (32-bit)

CA FE BA BE EF BB BF

0 0

class

FE ED FA CE

........

0 or typically 0x1000 0 or typically 0x1000 0

FE ED FA CF

........

Mach-O binary (64-bit)

CE FA ED FE

........

Mach-O binary (reverse byte ordering [4] scheme, 32-bit) Mach-O binary (reverse byte ordering [5] scheme, 64-bit) Byte-order mark for text file encoded in little-endian 16-bit Unicode Transfer Format Byte-order mark for text file encoded in little-endian 32-bit Unicode Transfer Format pdf asf, wma, wmv PDF documents Advanced Systems Format

CF FA ED FE

........

FF FE

..

FF FE 00 00

....

25 50 44 46 30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C 24 53 44 49 30 30 30 31

%PDF 0&u.f. ..bl

0 0

$SDI0001

System Deployment Image, a disk image format used by Microsoft ogg, oga, ogv psd Ogg, an open source media container format Photoshop Document file, Adobe Photoshop's native file format MPEG-1 Layer 3 file without an ID3 tag or with an ID3v1 tag (which's appended at the end of the file) MP3 file with an ID3v2 container BMP file, a bitmap format used mostly in the Windows world ISO9660 CD/DVD image file

4F 67 67 53 38 42 50 53

OggS 8BPS

0 0

FF FB

mp3

49 44 33 42 4D

ID3 BM

0 0

mp3 bmp, dib

43 44 30 30 31

CD001

0x8001, 0x8801 or 0x9001

iso

53 49 4d 50 4c 45 20 20 3d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 66 4C 61 43 4D 54 68 64 D0 CF 11 E0 64 65 78 0A 30 33 35 00

SIMPLE=T 0

fits

Flexible Image Transport System (FITS)

fLaC MThd

0 0

flac mid, midi doc

Free Lossless Audio Codec MIDI sound file [6]

Microsoft Office documents Dalvik Executable

dex 035

dex

List of file signatures

References
[1] [2] [3] [4] Icons (http:/ / msdn. microsoft. com/ en-us/ library/ ms997538. aspx) (at MSDN) GRAPHICS INTERCHANGE FORMAT(sm) Version 89a (http:/ / www. w3. org/ Graphics/ GIF/ spec-gif89a. txt) PNG (Portable Network Graphics) Specification Version 1.0 (http:/ / tools. ietf. org/ html/ rfc2083) OS X ABI Mach-O File Format Reference (https:/ / developer. apple. com/ library/ mac/ #documentation/ DeveloperTools/ Conceptual/ MachORuntime/ Reference/ reference. html) [5] OS X ABI Mach-O File Format Reference (https:/ / developer. apple. com/ library/ mac/ #documentation/ DeveloperTools/ Conceptual/ MachORuntime/ Reference/ reference. html) [6] http:/ / filesignatures. net/ index. php?search=mid& mode=EXT

External links
Gary Kessler's list of file signatures (http://www.garykessler.net/library/file_sigs.html) Online File Signature Database for Forensic Practitioners, a private compilation free to Law Enforcement (http:// www.filesig.co.uk/ofsdb.html) Man page for compress, uncompress, and zcat on SCO Open Server (http://docsrv.sco.com:507/en/man/html. C/compress.C.html) Public Database of File Signatures (http://www.filesignatures.net)

Article Sources and Contributors

Article Sources and Contributors

List of file signatures Source: http://en.wikipedia.org/w/index.php?oldid=568205777 Contributors: CoolKoon, Darren Olivier, Eric.B.Budd, Filesig, Franz Waldmann, GhostInTheMachine, Henning Makholm, Jahibadkaret, Jdaloner, Jkl, K7.india, Kim Moser, Loadmaster, MuffledThud, Ondertitel, Pafideas, Ratneshmaurya, Ravana 999, Ronjmatthews, Sbj3, Thryduulf, Tom Morris, Uncopy, Wevah, 21 anonymous edits

License
Creative Commons Attribution-Share Alike 3.0 //creativecommons.org/licenses/by-sa/3.0/