List of file signatures
- This is a dynamic list and may never be able to satisfy particular standards for completeness. You can help by expanding it with reliably sourced entries.
This is a list of file signatures, data used to identify or verify the content of a file. Such signatures are also known as magic numbers.
Many binary file formats are not intended to be read as text. If such a file is accidentally viewed as a text file, its contents will be unintelligible. However, sometimes the file signature can be recognizable when interpreted as text. The column ISO 8859-1 shows how the file signature appears when interpreted as text in the common ISO 8859-1 encoding.
File extension | Description | Offset | ISO 8859-1 | Hex signature |
---|---|---|---|---|
PIC PIF SEA YTR |
IBM Storyboard bitmap file Windows Program Information File |
0 | . |
00 |
PDB | PalmPilot Database/Document File | 11 | ........ ........ ........ |
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
DBA | Palm Desktop Calendar Archive | 0 | ... |
BE BA FE CA |
DBA | Palm Desktop To Do Archive | 0 | ... |
00 01 42 44 |
TDA | Palm Desktop Calendar Archive | 0 | ... |
00 01 44 54 |
Palm Desktop Data File (Access format) | 0 | ... |
00 01 00 00 | |
ico | Computer icon encoded in ICO file format[1] | 0 | .... |
00 00 01 00 |
3gp 3g2 |
3rd Generation Partnership Project 3GPP and 3GPP2 multimedia files | 4 | ftyp 3g |
66 74 79 70 33 67 |
z tar.z |
compressed file (often tar zip) using Lempel-Ziv-Welch algorithm |
0 | .. |
1F 9D |
z tar.z |
Compressed file (often tar zip) using LZH algorithm |
0 | .. |
1F A0 |
bac | File or tape containing a backup done with AmiBack on an Amiga.
It typically is paired with an index file (idx) with the table of contents. |
0 | BACKMIKE DISK |
42 41 43 4B 4D 49 4B 45 44 49 53 4B |
bz2 | Compressed file using Bzip2 algorithm | 0 | BZh |
42 5A 68 |
gif | Image file encoded in the Graphics Interchange Format (GIF)[2] | 0 | GIF87a GIF89a |
47 49 46 38 37 61 47 49 46 38 39 61 |
tif tiff |
Tagged Image File Format | 0 | II*. MM.* |
49 49 2A 00(little endian format) 4D 4D 00 2A(big endian format) |
cr2 | Canon RAW Format Version 2[3] Canon's RAW format is based on the TIFF file format [4] |
0 | II*..... CR |
49 49 2A 00 10 00 00 00 43 52 |
cin | Kodak Cineon image | 0 | .*_. |
80 2A 5F D7 |
dpx | SMPTE DPX image | 0 | SDPX XPDS |
53 44 50 58(big endian format) 58 50 44 53 (little endian format) |
exr | OpenEXR image | 0 | v/1. |
76 2F 31 01 |
bpg | Better Portable Graphics format[5] | 0 | BPGû |
42 50 47 FB |
jpg jpeg |
JPEG raw or in the JFIF or Exif file format | 0 | ÿØÿÛ ÿØÿà ..J F IF.. ÿØÿá ..E x if.. |
FF D8 FF DB FF D8 FF E0 nn nn 4A 46 49 46 00 01 FF D8 FF E1 nn nn 45 78 69 66 00 00 |
ilbm lbm ibm iff |
IFF Interleaved Bitmap Image | 0
any |
FORM.... ILBM |
46 4F 52 4D nn nn nn nn 49 4C 42 4D |
8svx 8sv svx snd iff |
IFF 8-Bit Sampled Voice | 0
any |
FORM.... 8SVX |
46 4F 52 4D nn nn nn nn 38 53 56 58 |
acbm iff |
Amiga Contiguous Bitmap | 0
any |
FORM.... ACBM |
46 4F 52 4D nn nn nn nn 41 43 42 4D |
anbm iff |
IFF Animated Bitmap | 0
any |
FORM.... ANBM |
46 4F 52 4D nn nn nn nn 41 4E 42 4D |
anim iff |
IFF CEL Animation | 0
any |
FORM.... ANIM |
46 4F 52 4D nn nn nn nn 41 4E 49 4D |
faxx fax iff |
IFF Facsimile Image | 0
any |
FORM.... FAXX |
46 4F 52 4D nn nn nn nn 46 41 58 58 |
ftxt txt iff |
IFF Formatted Text | 0
any |
FORM.... FTXT |
46 4F 52 4D nn nn nn nn 46 54 58 54 |
smus smu mus iff |
IFF Simple Musical Score | 0
any |
FORM.... SMUS |
46 4F 52 4D nn nn nn nn 53 4D 55 53 |
cmus mus iff |
IFF Musical Score | 0
any |
FORM.... CMUS |
46 4F 52 4D nn nn nn nn 43 4D 55 53 |
yuvn yuv iff |
IFF YUV Image | 0
any |
FORM.... YUVN |
46 4F 52 4D nn nn nn nn 59 55 56 4E |
iff | Amiga Fantavision Movie | 0
any |
FORM.... FANT |
46 4F 52 4D nn nn nn nn 46 41 4E 54 |
aiff aif aifc snd iff |
Audio Interchange File Format | 0
any |
FORM.... AIFF |
46 4F 52 4D nn nn nn nn 41 49 46 46 |
idx | Index file to a file or tape containing a backup done with AmiBack on an Amiga. | 0 | INDX |
49 4E 44 58 |
exe | DOS MZ executable file format and its descendants (including NE and PE) | 0 | MZ |
4D 5A |
zip jar odt ods odp docx xlsx pptx vsdx apk |
zip file format and formats based on it, such as JAR, ODF, OOXML | 0 | PK.. |
50 4B 03 04 50 4B 05 06 (empty archive) 50 4B 07 08 (spanned archive) |
rar | RAR archive version 1.50 onwards[6] | 0 | Rar!... |
52 61 72 21 1A 07 00 |
rar | RAR archive version 5.0 onwards[7] | 0 | Rar!.... |
52 61 72 21 1A 07 01 00 |
Executable and Linkable Format | 0 | .ELF |
7F 45 4C 46 | |
png | Image encoded in the Portable Network Graphics format[8] | 0 | .PNG.... |
89 50 4E 47 0D 0A 1A 0A |
class | Java class file, Mach-O Fat Binary | 0 | Êþº¾ |
CA FE BA BE |
UTF-8 encoded Unicode byte order mark, commonly seen in text files. | 0 |  |
EF BB BF | |
Mach-O binary (32-bit) | 0
0x1000 |
........ |
FE ED FA CE | |
Mach-O binary (64-bit) | 0
0x1000 |
........ |
FE ED FA CF | |
Mach-O binary (reverse byte ordering scheme, 32-bit)[9] | 0 | ........ |
CE FA ED FE | |
Mach-O binary (reverse byte ordering scheme, 64-bit)[9] | 0 | ........ |
CF FA ED FE | |
Byte-order mark for text file encoded in little-endian 16-bit Unicode Transfer Format | 0 | .. |
FF FE | |
Byte-order mark for text file encoded in little-endian 32-bit Unicode Transfer Format | 0 | .... |
FF FE 00 00 | |
ps | PostScript document | 0 | %!PS |
25 21 50 53 |
PDF document | 0 | |
25 50 44 46 | |
asf wma wmv |
Advanced Systems Format[10] | 0 | 0&²u.fÏ .¦Ù.ª.bÎl |
30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C |
System Deployment Image, a disk image format used by Microsoft | 0 | $SDI0001 |
24 53 44 49 30 30 30 31 | |
ogg oga ogv |
Ogg, an open source media container format | 0 | OggS |
4F 67 67 53 |
psd | Photoshop Document file, Adobe Photoshop's native file format | 0 | 8BPS |
38 42 50 53 |
wav | Waveform Audio File Format | 0 | RIFF.... WAVE |
52 49 46 46 nn nn nn nn 57 41 56 45 |
avi | Audio Video Interleave video format | 0 | RIFF.... AVI. |
52 49 46 46 nn nn nn nn 41 56 49 20 |
mp3 | MPEG-1 Layer 3 file without an ID3 tag or with an ID3v1 tag (which's appended at the end of the file) | 0 | ˙ű |
FF FB |
mp3 | MP3 file with an ID3v2 container | 0 | ID3 |
49 44 33 |
bmp dib |
BMP file, a bitmap format used mostly in the Windows world | 0 | BM |
42 4D |
iso | ISO9660 CD/DVD image file[11] | 0x8001 0x8801 |
CD001 |
43 44 30 30 31 |
fits | Flexible Image Transport System (FITS)[12] | 0 | SIMPLE = T |
53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 |
flac | Free Lossless Audio Codec[13] | 0 | fLaC |
66 4C 61 43 |
mid midi |
MIDI sound file[14] | 0 | MThd |
4D 54 68 64 |
doc xls ppt msg |
Microsoft Office documents[15] | D0 CF 11 E0 A1 B1 1A E1 | ||
dex | Dalvik Executable | 0 | dex.035. |
64 65 78 0A 30 33 35 00 |
vmdk | VMDK files [16][17] | 0 | KDM |
4B 44 4D |
crx | Google Chrome extension[18] or packaged app[19] | 0 | Cr24 |
43 72 32 34 |
fh8 | FreeHand 8 document[20][21][22] | 0 | AGD3 |
41 47 44 33 |
cwk | AppleWorks 5 document | 0 | ....BOBO ........ .... |
05 07 00 00 42 4F 42 4F 05 07 00 00 00 00 00 00 00 00 00 00 00 01 |
cwk | AppleWorks 6 document | 0 | ....BOBO ........ .... |
06 07 E1 00 42 4F 42 4F 06 07 E1 00 00 00 00 00 00 00 00 00 00 01 |
toast | Roxio Toast disc image file, also some .dmg-files begin with same bytes | 0 | ER.... ãER.... |
45 52 02 00 00 00 8B 45 52 02 00 00 00 |
dmg | Apple Disk Image file | 0 | x.s.bb` |
78 01 73 0D 62 62 60 |
xar | eXtensible ARchive format[23] | 0 | xar! |
78 61 72 21 |
dat | Windows Files And Settings Transfer Repository[24]
See also USMT 3.0 (Win XP)[25] and USMT 4.0 (Win 7)[26] User Guides |
0 | PMOCCMOC |
50 4D 4F 43 43 4D 4F 43 |
nes | Nintendo Entertainment System ROM file [27] | 0 | NES |
4E 45 53 1A |
tar | tar archive[28] | 0x101 | ustar.00 ustar . |
75 73 74 61 72 00 30 30 75 73 74 61 72 20 20 00 |
tox | Open source portable voxel file [29] | 0 | TOX |
74 6F 78 33 |
MLV | Magic Lantern Video file[30] | 0 | MLVI |
4D 4C 56 49 |
Windows Update Binary Delta Compression[31] | 0 | DCM PA30 |
44 43 4D 01 50 41 33 30 | |
7z | 7-Zip File Format | 0 | 7z¼¯' |
37 7A BC AF 27 1C |
gz tar.gz |
GZIP | 0 | .. |
1F 8B |
lz4 | LZ4 Streaming Format[32] Remark: LZ4 compressed data (file) format does not offer any magic bytes.[33] |
0 | ."M. |
04 22 4D 18 |
cab | Microsoft Cabinet file | 0 | MSCF |
4D 53 43 46 |
flif | Free Lossless Image Format | 0 | FLIF |
46 4C 49 46 |
mkv mka mks mk3d webm |
Matroska media container, including WebM | 0 | .Eߣ |
1A 45 DF A3 |
djvu djv |
DjVu document The following byte is either 55 (U ) for single-page or 4D (M ) for multi-page documents. |
0 | AT&TFORM....DJV |
41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56 |
File extension | Description | Offset | ISO 8859-1 | Hex signature |
See also
References
- ↑ Icons (at MSDN)
- ↑ GRAPHICS INTERCHANGE FORMAT(sm) Version 89a
- ↑ Computer Knowledge. "File Extension .CR2 Details". filext.com.
- ↑ "Inside the Canon RAW format version 2, understanding .CR2 file format and files produced by Canon EOS Digital Camera". free.fr.
- ↑ Bellard, Fabrice (2015). "BPG Image format".
- ↑ "TechNote.txt: RAR version 4.00 - Technical information". 2010-12-01.
The marker block is actually considered as a fixed byte sequence: 0x52 0x61 0x72 0x21 0x1a 0x07 0x00
- ↑ "RAR 5.0 archive format". Retrieved 2013-05-01.
- ↑ "RFC 2083 - PNG (Portable Network Graphics) Specification Version 1.0". ietf.org.
- 1 2 "Mac Developer Library". apple.com.
- ↑ "ASF (Advanced Systems Format)".
- ↑ Gary C. Kessler (21 October 2012). "File Signatures Table". Retrieved 28 December 2012.
- ↑ "Flexible Image Transport System (FITS), Version 3.0 - File type signifiers". 2012-09-26. Retrieved 24 January 2013.
- ↑ Josh Coalson. "FLAC — format". Retrieved 4 April 2013.
"fLaC", the FLAC stream marker in ASCII, meaning byte 0 of the stream is 0x66, followed by 0x4C 0x61 0x43
- ↑ "File Signature Database: mid File Signatures". filesignatures.net.
- ↑
- ↑ "What Files Make Up a Virtual Machine?". vmware.com.
- ↑ http://www.vmware.com/app/vmdk/?src=vmdk
- ↑ "CRX Package Format". chrome.com.
- ↑ "CRX Package Format". chrome.com.
- ↑ "[Pythonmac-SIG] Discovering file type". python.org.
- ↑ Tim Fisher. "FH8 File - What It Is & How To Open One". About.com Tech.
- ↑ "Google Groups". google.com.
- ↑ "xarformat - xar - xarchive format - eXtensible ARchiver - Google Project Hosting". google.com. line feed character in
|title=
at position 13 (help) - ↑ "Easily Restore Your Computer With File and Settings Transfer Wizard XP (Part 1)". howtogeek.com.
- ↑ "User State Migration Tool 3.0". microsoft.com. Microsoft.
- ↑ "User State Migration Tool 4.0 User's Guide". microsoft.com. Microsoft.
- ↑ "NESRomTool::NES ROM Quickstart". sadistech.com.
- ↑ "GNU tar 1.28: Basic Tar Format". gnu.org.
- ↑ "UVOX Universal Voxel Translator - Man Page". tox.land.
- ↑ "RAW Format v2.0 - Google Sheets". google.com.
- ↑ "Using Binary Delta Compression (BDC) Technology to Update Windows Operating Systems". Microsoft. 10 June 2005. Retrieved 15 March 2015.
- ↑ "LZ4 Streaming format". gw.com.
- ↑ Yann Collet. "RealTime Data Compression". fastcompression.blogspot.de.
External links
- Gary Kessler's list of file signatures
- Online File Signature Database for Forensic Practitioners, a private compilation free to Law Enforcement
- Man page for compress, uncompress, and zcat on SCO Open Server
- Public Database of File Signatures
- Complete list of magic numbers with sample files