This table of file signatures aka "magic numbers" is a continuing work-in-progress. I had found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T.

Jenkinson Springer, ; that was my inspiration to start this list in See also Wikipedia's List of file signatures. Comments, additions, and queries can be sent to Gary Kessler at gck garykessler.

This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:.

My software utility page contains a custom signature file based upon this list, for use with FTK, Scalpel, Simple Carver, Simple Carver Lite, and TrID. The File Signatures Web site searches a database based upon file extension or file signature. Also, see Tim's SQLite Database Catalog page, "a repository of information used to identify specific SQLite databases and properties for research purposes.

Marco Pontello's TrID - File Identifier utility designed to identify file types from their binary signatures. The National Archives' PRONOM site provides on-line information about data file formats and their supporting software products, as well as their multi-platform DROID Digital Record Object Identification software. Additional details on graphics file formats can be found at The Graphics File Formats Page and the Sustainability of Digital Formats Planning for Library of Congress Collections site.

Additional details on audio and video file formats can be found at the Sustainability of Digital Formats Planning for Library of Congress Collections site. Another collection of many types of file format specifications can be found at Alex Kirk's File Format Documentation Collection.

Shaul Zevin's Let's Solve the File Format Problem! The following individuals have given me updates or suggestions for this list over the years: I thank them and apologize if I have missed anyone. I would like to give particular thanks to Danny Mares of Mares and Companyauthor of the MaresWare Suite primarily for the "subheaders" for many of the file types hereand the people at X-Ways Forensics for their permission to incorporate their lists of file signatures.

Nicole Beebe from The University of Texas at San Antonio posted samples of more than 32 file types at the Digital Corpora, which I used for verification and additional signatures. These files were used to develop the Sceadan File Type Classifier. The file samples can be downloaded from the Digital Corpora website. Permission to use the material here is extended to any of this page's visitors, as long as appropriate attribution is provided and the information is not altered in any way without express written permission of the author.

Truevision Targa Graphic file Trailer: MPEG video file Trailer: Amiga Hunk executable file. It appears that the byte following the 0x52 "R" is the language indicator; 0x33 "3" seems to indicate English and 0x61 "a" reportedly indicates Korean.

See the Unicode Home Page. Mbox table of contents file. The next four bytes appear to be the number of e-mails in the associated mbox file. Firebird and Interbase database files, respectively. See IBPhoenix for more information. INFO2 Windows recycle bin file. Possibly, maybe, might be a fragment of an Ethernet frame carrying an IPv4 packet.

See Hints About Looking for Network Packet Fragments. Compressed tape archive file using standard Lempel-Ziv-Welch compression. Compressed tape archive file using LZH Lempel-Ziv-Huffman compression.

Changing Defaults for Commands and Options - Smartcrypt - PKWARE Support Site

Unix archiver ar files and Microsoft Program Library Common Object File Format COFF. Microsoft Outlook Exchange Offline Storage Folder File.

Microsoft Outlook Exchange Personal Folder File. Adaptive Multi-Rate ACELP Algebraic Code Excited Linear Prediction Codec, commonly audio format with GSM cell phones. Audio compression format developed by Skype; also used by other applications. Adobe encapsulated PostScript file If this signature is not at the immediate beginning of the file, it will occur early in the file, commonly at byte offset 30 [0x1E].

Adobe Portable Document Format, Forms Document Format, and Illustrator graphics files Trailers: There may be multiple end-of-file marks within the file. When carving, be sure to get the last one.

This fi le must be conve rted wit h BinHex. Nz dollar exchange rate against us dollar created with the cpio utility where nn values 0x37 "7"0x31 "1"and opening hours hong kong stock exchange "2" refer to the standard ASCII format, new ASCII aka SVR4 format, and CRC format, respectively.

The swpackage 8 page pksfx and options additional information. See the libburnia page for additional information. GPS eXchange file v1. ASCII85 aka BASE85 encoded file, sometimes used with PostScript and PDF. NOTES on AutoCAD file headers: The 0x AC10 is a generic header, occupying the first four bytes in the file. The next two bytes give further indication about the version or subtype: AES Crypt file format.

Call of juarez gunslinger shadow option fourth byte is the version number. AOL personal file cabinet PFC file NOTE: The signature above is correct for the generic 1929 stock market crash articles six bytes.

Windows or device-independent bitmap image NOTE: Bytes contain the file length in little-endian order. Better Portable Graphics image format. Puffer ASCII-armored encrypted archive. Electronic Arts' Interchange Format Files IFF format. ISO CD Disc Image This signature usually occurs at byte offset 0x0xor 0x More information can be found at MacTech or stock market during reagan administration ECMA.

Macromedia Shockwave Flash player file zlib compressed, SWF 6 and later. See SWF File Format Specification. Microsoft Internet Explorer cache file index. Expert Witness Compression Format EWF file, including EWF-E01 and EWF-S01, as used in EnCase and SMART evidence files.

See the EWF specification. See the EVFv2 specification. Macromedia Shockwave Flash player file uncompressed. A commmon file extension for e-mail files.

Signatures shown here are for Netscape, Eudora, and a generic signature, respectively. EML is also used by Outlook Stock market training course chennai and QuickMail. MPEG transport stream file. This is not long term and short term relationship between malaysian economy and stock market lot to go on, but MPEG-2 Part 1 Transport MP2T files are reportedly broken into byte packets and the 0x47 byte is the sync byte, so should repeat every bytes in the file.

Graphics interchange format file Trailer: Canon digital camera RAW file. Canon digital camera RAW file Ref. Inter ctive Pager Backup BlackBerry backup file See selling penny stocks scottrade IPD File Format page or IPD File pksfx and options BlackBerry. AOL ART file Trailers: KWAJ file format used by DOS COMPRESS.

This command compresses a single file, replacing the last character in the file name with an underscore or dollar sign, e. BAZ would be renamed FOO.

Windows shell link shortcut file. See also The Meaning of Linkfiles in Forensic Examinations and Evidentiary Value of Link Files.

- Category not found

Logical File How much money zoos make Format EWF-L01 as used in later versions of EnCase evidence files. Synthetic music Mobile Binary options trader franco pellegrino Format SMAF for multimedia files that can be played on hand-held devices.

MZ are the initals of Mark Zbikowski, designer of the DOS executable file format. PKZIP archive file Ref. PK are the initals of Phil Katz, co-creator of the ZIP file format and author of PKZIP. Apple Mac OS X Dashboard Widget, Aston Shell theme, Oolite eXpansion Pack, Opera Widget, Pivot Style Template, Rockbox Theme package, Simple Machines Forums theme, SubEthaEdit Mode, Trillian zipped skin, Virtual Skipper skin.

OpenOffice spreadsheet Calcdrawing Drawpresentation Impressand word processing Writer files, respectively. Open Publication Structure eBook file. Should also include the string: Microsoft Office Open XML Format OOXML Document NOTE: There is no subheader for MS OOXML files as there is with DOC, PPT, and XLS files.

To better understand the format of these files, rename any OOXML file to have a. Look for 50 4B 05 06 PK. Resource Interchange File Format -- Windows Audio Video Interleave filewhere xx xx xx xx is the file size little endian. Resource Interchange File Format -- Compact Disc Digital Audio CD-DA file, where xx xx xx xx is the file size little endian.

Resource Interchange File Format -- Qualcomm PureVoice, where xx xx xx xx is the file size little endian. Resource Interchange File Format -- Windows Musical Instrument Digital Interface filewhere xx xx xx xx is the file size little endian. Resource Interchange File Format -- Audio for Windows filewhere xx xx xx xx is the file size little endian.

Google WebP image filewhere xx xx xx xx is the file size. RAR v5 compressed archive file. The first four bytes indicate the OS: Society of Motion Picture and Television Engineers SMPTE Digital Picture Exchange DPX image file big endian. Flexible Image Transport System FITSVersion 3. QBASIC SZDD file header variant.

See the SZDD or KWAJ format entries for additional information. SZDD file format used by DOS COMPRESS. Likely type is Harvard Graphics Version 2. Cinco NetXRay, Network General Sniffer, and Network Associates Sniffer capture file. Society of Motion Picture and Television Engineers SMPTE Digital Picture Exchange DPX image file little endian.

Macromedia Shockwave Flash player file LZMA compressed, SWF 13 and later. UUencoded files start with a string: See this uuencode page for more information. UUencoded BASE64 file Trailer: Binary property list plist NOTE: Next two bytes are the version number, currently 0x, or "00".

pksfx command line options

Apple Core Audio File. GNU Image Manipulation Program GIMP eXperimental Computing Facility XCF image file. MOV files have a complicated file signature. The string " moov " is the most common but I have also seen: For more information, see the QuickTime File Format page. Wright for getting me started on this! Short Message Service SMSor text, message stored on a Subscriber Identification Module SIM.

ASCII STL STereoLithography file for 3D printing. Tape Archive file http: Rich text format word processing file Trailer: Reportedly a proprietary recording system, possibly a Digital Watchdog DW-TPG unit. Possibly, maybe, might be a fragment of an Ethernet frame carrying an IPv6 packet. Portable Network Graphics file Trailer: Java serialization data see Object Serialization Stream Protocol.

Java Cryptography Extension keystore file. Apple OS X ABI Mach-O binary file bit, where target system has reverse byte ordering from host running compiler. DOCDOT, PPS, PPTXLA, XLSWIZ. An Object Linking and Embedding OLE Compound File CF i. There have been reports that there are different subheaders for Windows and Mac versions of MS Office but I cannot confirm that. Byte-order mark BOM for 8-bit Unicode Transformation Format UTF-8 files.

Apple OS X ABI Mach-O binary file bit. Digital camera JPG using Exchangeable Image File Format EXIF Trailer: Alvarez, IJDE2 3Winter and ExifTool Tag Names. Still Picture Interchange File Format SPIFF Trailer: NOTES on JPEG file headers: It appears that one can safely say that all JPEG files start with the three hex digits 0xFF-D8-FF.

The fourth digit is also indicative of JPEG content. Still Picture Interchange File Format SPIFF. MPEG audio file frame synch pattern.