A python library for identifying files by headers (magic bytes).
based on info from: 'Wikipedia - List of file signatures'
Still alpha, but code should be easy enough to follow and expand upon.
Thanks to all contributors!!
Example use:
# returns a Match object (list of signatures) that match the file 'f'
with open(f_name, "rb") as f:
derp = get_from_file(f)
# returns Match object (list of signatures) that match the file at this file path
herp = get_from_path(f_name)
# this can be a string or a bytestring, will raise exception if no matching headers found.
Matches(header="%PDF")A method that compares a two file headers, the first one directly read from a file, the second is a a string containing space delimited hexidecimal byte codes. its a string becuase 'nn' is used to represent a wildcard byte.
This is the first x bytes of a file, this can be obtained by opening the file using open(file_name, 'rb') mode.
To obtain only the first few bytes use the following:
with open(file_name, 'rb') as f:
header = f.read(32)This is the string of space delimited hexidecimal byte codes representing the file signature.
'nn' is used to represent a wildcard byte
example:
# for example, "%PDF"
test_hex_string = "25 50 44 46"
# showing wildcards, %P**DF
test_hex_string = "25 50 nn nn 44 46"Return a Match object of all the matching Signatures for this file
'f' is the open file object.
Note: you can use textIO to get a file like object from a string
This is the length in bytes read from the start of the file used as the file header.
Return a Match object of all the matching signatures for this file, using the path rather than a file object now.
'path' is the path to a file, it is passed into open() so it can be relative if you like.
This is the length in bytes read from the start of the file used as the file header.
A class that reimplements a dictionary. These are initialised and returned as part of the Match class when a Byte signature is tested using the file_signatures.compare() function.
A suggested file extension for this type of file
A brief description of the file type taken from 'List of file signatures'.
Not implemented yet...
ASCII interpretation of the file signature eg. '%PDF'
The space delimited hexidecimal byte codes representing the file signature.
example:
# for example, "%PDF"
test_hex_string = "25 50 44 46"(see above test_hex_string)
This is a list reimplemented, it is returned by get_from_file and get_from_path defs. It holds a list Signature objects.
This is a basic exception used when a match cannot be found.
Use
try: except:statements in your code if you dont like this.
a list of dictionary items representing a file signature class. Used to check against and initialise new Signatures.
example:
# example entry from file_signatures.signatures list
{'ascii': 'v/1.',
'description': 'OpenEXR image',
'file_extension': 'exr',
'hex': '76 2F 31 01',
'offset': '0'}# Wikipedia License
# -----------------
#
# This Library uses material from the Wikipedia article
# https://en.wikipedia.org/wiki/List_of_file_signatures, which is released
# under the Creative Commons Attribution-Share-Alike License 3.0
signatures = [{'ascii': '....',
'description': 'RedHat Package Manager (RPM) package',
'file_extension': 'rpm',
'hex': 'ed ab ee db',
'offset': '0'},
{'ascii': 'SP01',
'description': 'Amazon Kindle Update Package',
'file_extension': 'bin',
'hex': '53 50 30 31',
'offset': '0'},
{'ascii': '.',
'description': 'WindowsProgram Information File',
'file_extension': 'PIF',
'hex': '00 nn',
'offset': '0'},
{'ascii': '.',
'description': 'MacStuffit Self-Extracting Archive',
'file_extension': 'SEA',
'hex': '00 nn',
'offset': '0'},
{'ascii': '.',
'description': 'IRISOCR data file',
'file_extension': 'YTR',
'hex': '00 nn',
'offset': '0'},
{'ascii': '.',
'description': 'IBM Storyboard bitmap file',
'file_extension': 'PIC',
'hex': '00 nn',
'offset': '0'},
{'ascii': '........ ........ ........',
'description': 'PalmPilot Database/Document File',
'file_extension': 'PDB',
'hex': '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
'00',
'offset': '11'},
{'ascii': '...',
'description': 'Palm Desktop Calendar Archive',
'file_extension': 'DBA',
'hex': 'BE BA FE CA',
'offset': '0'},
{'ascii': '..BD',
'description': 'Palm Desktop To Do Archive',
'file_extension': 'DBA',
'hex': '00 01 42 44',
'offset': '0'},
{'ascii': '..DT',
'description': 'Palm Desktop Calendar Archive',
'file_extension': 'TDA',
'hex': '00 01 44 54',
'offset': '0'},
{'ascii': '...',
'description': 'Palm Desktop Data File (Access format)',
'file_extension': '',
'hex': '00 01 00 00',
'offset': '0'},
{'ascii': '....',
'description': 'Computer icon encoded inICO file format',
'file_extension': 'ico',
'hex': '00 00 01 00',
'offset': '0'},
{'ascii': 'ftyp 3g',
'description': '3rd Generation Partnership Project3GPP',
'file_extension': '3gp',
'hex': '66 74 79 70 33 67',
'offset': '4'},
{'ascii': 'ftyp 3g',
'description': '3GPP2 multimedia files',
'file_extension': '3g2',
'hex': '66 74 79 70 33 67',
'offset': '4'},
{'ascii': '..',
'description': 'compressed file (often tar zip)',
'file_extension': 'z',
'hex': '1F 9D',
'offset': '0'},
{'ascii': '..',
'description': 'usingLempel-Ziv-Welch algorithm',
'file_extension': 'tar.z',
'hex': '1F 9D',
'offset': '0'},
{'ascii': '..',
'description': 'Compressed file (often tar zip)',
'file_extension': 'z',
'hex': '1F A0',
'offset': '0'},
{'ascii': '..',
'description': 'usingLZH algorithm',
'file_extension': 'tar.z',
'hex': '1F A0',
'offset': '0'},
{'ascii': 'BACKMIKE DISK',
'description': 'File ortape containing abackup done withAmiBack on an Amiga. '
'It typically is paired with an index file (idx) with the '
'table of contents.',
'file_extension': 'bac',
'hex': '42 41 43 4B 4D 49 4B 45 44 49 53 4B',
'offset': '0'},
{'ascii': 'BZh',
'description': 'Compressed file usingBzip2 algorithm',
'file_extension': 'bz2',
'hex': '42 5A 68',
'offset': '0'},
{'ascii': 'GIF87aGIF89a',
'description': 'Image file encoded in theGraphics Interchange Format (GIF)',
'file_extension': 'gif',
'hex': '47 49 46 38 37 61 47 49 46 38 39 61',
'offset': '0'},
{'ascii': 'II*.MM.*',
'description': 'Tagged Image File Format (little endian format)',
'file_extension': 'tif',
'hex': '49 49 2A 00',
'offset': '0'},
{'ascii': 'II*.MM.*',
'description': 'Tagged Image File Format (little endian format)',
'file_extension': 'tiff',
'hex': '49 49 2A 00',
'offset': '0'},
{'ascii': 'II*.MM.*',
'description': 'Tagged Image File Format (big endian format)',
'file_extension': 'tif',
'hex': '4D 4D 00 2A',
'offset': '0'},
{'ascii': 'II*.MM.*',
'description': 'Tagged Image File Format (big endian format)',
'file_extension': 'tiff',
'hex': '4D 4D 00 2A',
'offset': '0'},
{'ascii': 'II*..... CR',
'description': "Canon's RAW format is based on the TIFF file format",
'file_extension': 'cr2',
'hex': '49 49 2A 00 10 00 00 00 43 52',
'offset': '0'},
{'ascii': 'II*..... CR',
'description': 'Canon RAW Format Version 2',
'file_extension': 'cr2',
'hex': '49 49 2A 00 10 00 00 00 43 52',
'offset': '0'},
{'ascii': '.*_.',
'description': 'KodakCineon image',
'file_extension': 'cin',
'hex': '80 2A 5F D7',
'offset': '0'},
{'ascii': 'RNC.',
'description': 'Compressed file usingRob Northen Compression (version 1 and '
'2) algorithm',
'file_extension': '',
'hex': '52 4E 43 01 52 4E 43 02',
'offset': '0'},
{'ascii': 'SDPXXPDS',
'description': 'SMPTEDPX image (big endian format)',
'file_extension': 'dpx',
'hex': '53 44 50 58',
'offset': '0'},
{'ascii': 'SDPXXPDS',
'description': 'SMPTEDPX image (little endian format)',
'file_extension': 'dpx',
'hex': '58 50 44 53',
'offset': '0'},
{'ascii': 'v/1.',
'description': 'OpenEXR image',
'file_extension': 'exr',
'hex': '76 2F 31 01',
'offset': '0'},
{'ascii': 'BPGû',
'description': 'Better Portable Graphics format',
'file_extension': 'bpg',
'hex': '42 50 47 FB',
'offset': '0'},
{'ascii': 'ÿØÿÛ',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpg',
'hex': 'FF D8 FF DB',
'offset': '0'},
{'ascii': 'ÿØÿÛ',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpeg',
'hex': 'FF D8 FF DB',
'offset': '0'},
{'ascii': 'ÿØÿà ..J F IF..',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpg',
'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
'offset': '0'},
{'ascii': 'ÿØÿà ..J F IF..',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpeg',
'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
'offset': '0'},
{'ascii': 'ÿØÿá ..E x if..',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpg',
'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
'offset': '0'},
{'ascii': 'ÿØÿá ..E x if..',
'description': 'JPEG raw or in theJFIF orExif file format',
'file_extension': 'jpeg',
'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
'offset': '0'},
{'ascii': 'FORM.... ILBM',
'description': 'IFFInterleaved Bitmap Image',
'file_extension': 'ilbm',
'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ILBM',
'description': 'IFFInterleaved Bitmap Image',
'file_extension': 'lbm',
'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ILBM',
'description': 'IFFInterleaved Bitmap Image',
'file_extension': 'ibm',
'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ILBM',
'description': 'IFFInterleaved Bitmap Image',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... 8SVX',
'description': 'IFF8-Bit Sampled Voice',
'file_extension': '8svx',
'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
'offset': 'any'},
{'ascii': 'FORM.... 8SVX',
'description': 'IFF8-Bit Sampled Voice',
'file_extension': '8sv',
'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
'offset': 'any'},
{'ascii': 'FORM.... 8SVX',
'description': 'IFF8-Bit Sampled Voice',
'file_extension': 'svx',
'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
'offset': 'any'},
{'ascii': 'FORM.... 8SVX',
'description': 'IFF8-Bit Sampled Voice',
'file_extension': 'snd',
'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
'offset': 'any'},
{'ascii': 'FORM.... 8SVX',
'description': 'IFF8-Bit Sampled Voice',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
'offset': 'any'},
{'ascii': 'FORM.... ACBM',
'description': 'Amiga Contiguous Bitmap',
'file_extension': 'acbm',
'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ACBM',
'description': 'Amiga Contiguous Bitmap',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ANBM',
'description': 'IFFAnimated Bitmap',
'file_extension': 'anbm',
'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ANBM',
'description': 'IFFAnimated Bitmap',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
'offset': 'any'},
{'ascii': 'FORM.... ANIM',
'description': 'IFFCEL Animation',
'file_extension': 'anim',
'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
'offset': 'any'},
{'ascii': 'FORM.... ANIM',
'description': 'IFFCEL Animation',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
'offset': 'any'},
{'ascii': 'FORM.... FAXX',
'description': 'IFFFacsimile Image',
'file_extension': 'faxx',
'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
'offset': 'any'},
{'ascii': 'FORM.... FAXX',
'description': 'IFFFacsimile Image',
'file_extension': 'faxx',
'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
'offset': 'any'},
{'ascii': 'FORM.... FAXX',
'description': 'IFFFacsimile Image',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
'offset': 'any'},
{'ascii': 'FORM.... FTXT',
'description': 'IFFFormatted Text',
'file_extension': 'ftxt',
'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
'offset': 'any'},
{'ascii': 'FORM.... FTXT',
'description': 'IFFFormatted Text',
'file_extension': 'txt',
'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
'offset': 'any'},
{'ascii': 'FORM.... FTXT',
'description': 'IFFFormatted Text',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
'offset': 'any'},
{'ascii': 'FORM.... SMUS',
'description': 'IFFSimple Musical Score',
'file_extension': 'smus',
'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... SMUS',
'description': 'IFFSimple Musical Score',
'file_extension': 'smu',
'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... SMUS',
'description': 'IFFSimple Musical Score',
'file_extension': 'mus',
'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... SMUS',
'description': 'IFFSimple Musical Score',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... CMUS',
'description': 'IFFMusical Score',
'file_extension': 'cmus',
'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... CMUS',
'description': 'IFFMusical Score',
'file_extension': 'mus',
'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... CMUS',
'description': 'IFFMusical Score',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
'offset': 'any'},
{'ascii': 'FORM.... YUVN',
'description': 'IFFYUV Image',
'file_extension': 'yuvn',
'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
'offset': 'any'},
{'ascii': 'FORM.... YUVN',
'description': 'IFFYUV Image',
'file_extension': 'yuv',
'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
'offset': 'any'},
{'ascii': 'FORM.... YUVN',
'description': 'IFFYUV Image',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
'offset': 'any'},
{'ascii': 'FORM.... FANT',
'description': 'AmigaFantavision Movie',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 46 41 4E 54',
'offset': 'any'},
{'ascii': 'FORM.... AIFF',
'description': 'Audio Interchange File Format',
'file_extension': 'aiff',
'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
'offset': 'any'},
{'ascii': 'FORM.... AIFF',
'description': 'Audio Interchange File Format',
'file_extension': 'aif',
'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
'offset': 'any'},
{'ascii': 'FORM.... AIFF',
'description': 'Audio Interchange File Format',
'file_extension': 'aifc',
'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
'offset': 'any'},
{'ascii': 'FORM.... AIFF',
'description': 'Audio Interchange File Format',
'file_extension': 'snd',
'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
'offset': 'any'},
{'ascii': 'FORM.... AIFF',
'description': 'Audio Interchange File Format',
'file_extension': 'iff',
'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
'offset': 'any'},
{'ascii': 'INDX',
'description': 'Index file to a file ortape containing abackup done '
'withAmiBack on anAmiga.',
'file_extension': 'idx',
'hex': '49 4E 44 58',
'offset': '0'},
{'ascii': 'LZIP',
'description': 'lzip compressed file',
'file_extension': 'lz',
'hex': '4C 5A 49 50',
'offset': '0'},
{'ascii': 'MZ',
'description': 'DOS MZ executable file format and its descendants '
'(includingNE andPE)',
'file_extension': 'exe',
'hex': '4D 5A',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'zip',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'jar',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'odt',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'ods',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'odp',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'docx',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'xlsx',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'pptx',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'vsdx',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
'file_extension': 'apk',
'hex': '50 4B 03 04',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'zip',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'jar',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'odt',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'ods',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'odp',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'docx',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'xlsx',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'pptx',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'vsdx',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(empty archive)',
'file_extension': 'apk',
'hex': '50 4B 05 06',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'zip',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'jar',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'odt',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'ods',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'odp',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'docx',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'xlsx',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'pptx',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'vsdx',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'PK..',
'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
'(spanned archive)',
'file_extension': 'apk',
'hex': '50 4B 07 08',
'offset': '0'},
{'ascii': 'Rar!...',
'description': 'RAR archive version 1.50 onwards',
'file_extension': 'rar',
'hex': '52 61 72 21 1A 07 00',
'offset': '0'},
{'ascii': 'Rar!....',
'description': 'RAR archive version 5.0 onwards',
'file_extension': 'rar',
'hex': '52 61 72 21 1A 07 01 00',
'offset': '0'},
{'ascii': '.ELF',
'description': 'Executable and Linkable Format',
'file_extension': '',
'hex': '7F 45 4C 46',
'offset': '0'},
{'ascii': '.PNG....',
'description': 'Image encoded in thePortable Network Graphics format',
'file_extension': 'png',
'hex': '89 50 4E 47 0D 0A 1A 0A',
'offset': '0'},
{'ascii': 'Êþº¾',
'description': 'Java class file,Mach-O Fat Binary',
'file_extension': 'class',
'hex': 'CA FE BA BE',
'offset': '0'},
{'ascii': '',
'description': 'UTF-8 encodedUnicodebyte order mark, commonly seen in text '
'files.',
'file_extension': '',
'hex': 'EF BB BF',
'offset': '0'},
{'ascii': '........',
'description': 'Mach-O binary (32-bit)',
'file_extension': '',
'hex': 'FE ED FA CE',
'offset': '0'},
{'ascii': '........',
'description': 'Mach-O binary (32-bit)',
'file_extension': '',
'hex': 'FE ED FA CE',
'offset': '0x1000'},
{'ascii': '........',
'description': 'Mach-O binary (64-bit)',
'file_extension': '',
'hex': 'FE ED FA CF',
'offset': '0'},
{'ascii': '........',
'description': 'Mach-O binary (64-bit)',
'file_extension': '',
'hex': 'FE ED FA CF',
'offset': '0x1000'},
{'ascii': '........',
'description': 'Mach-O binary (reverse byte ordering scheme, 32-bit)',
'file_extension': '',
'hex': 'CE FA ED FE',
'offset': '0'},
{'ascii': '........',
'description': 'Mach-O binary (reverse byte ordering scheme, 64-bit)',
'file_extension': '',
'hex': 'CF FA ED FE',
'offset': '0'},
{'ascii': '..',
'description': 'Byte-order mark for text file encoded inlittle-endian16-bit '
'Unicode Transfer Format',
'file_extension': '',
'hex': 'FF FE',
'offset': '0'},
{'ascii': '....',
'description': 'Byte-order mark for text file encoded in little-endian32-bit '
'Unicode Transfer Format',
'file_extension': '',
'hex': 'FF FE 00 00',
'offset': '0'},
{'ascii': '%!PS',
'description': 'PostScript document',
'file_extension': 'ps',
'hex': '25 21 50 53',
'offset': '0'},
{'ascii': '%PDF',
'description': 'PDF document',
'file_extension': 'pdf',
'hex': '25 50 44 46',
'offset': '0'},
{'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
'description': 'Advanced Systems Format',
'file_extension': 'asf',
'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
'offset': '0'},
{'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
'description': 'Advanced Systems Format',
'file_extension': 'wma',
'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
'offset': '0'},
{'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
'description': 'Advanced Systems Format',
'file_extension': 'wmv',
'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
'offset': '0'},
{'ascii': '$SDI0001',
'description': 'System Deployment Image, a disk image format used byMicrosoft',
'file_extension': '',
'hex': '24 53 44 49 30 30 30 31',
'offset': '0'},
{'ascii': 'OggS',
'description': 'Ogg, anopen source media container format',
'file_extension': 'ogg',
'hex': '4F 67 67 53',
'offset': '0'},
{'ascii': 'OggS',
'description': 'Ogg, anopen source media container format',
'file_extension': 'oga',
'hex': '4F 67 67 53',
'offset': '0'},
{'ascii': 'OggS',
'description': 'Ogg, anopen source media container format',
'file_extension': 'ogv',
'hex': '4F 67 67 53',
'offset': '0'},
{'ascii': '8BPS',
'description': "Photoshop Document file,Adobe Photoshop's native file format",
'file_extension': 'psd',
'hex': '38 42 50 53',
'offset': '0'},
{'ascii': 'RIFF.... WAVE',
'description': 'Waveform Audio File Format',
'file_extension': 'wav',
'hex': '52 49 46 46 nn nn nn nn 57 41 56 45',
'offset': '0'},
{'ascii': 'RIFF.... AVI.',
'description': 'Audio Video Interleave video format',
'file_extension': 'avi',
'hex': '52 49 46 46 nn nn nn nn 41 56 49 20',
'offset': '0'},
{'ascii': 'ÿû',
'description': 'MPEG-1 Layer 3 file without anID3 tag or with anID3v1 tag '
"(which's appended at the end of the file)",
'file_extension': 'mp3',
'hex': 'FF FB',
'offset': '0'},
{'ascii': 'ID3',
'description': 'MP3 file with an ID3v2 container',
'file_extension': 'mp3',
'hex': '49 44 33',
'offset': '0'},
{'ascii': 'BM',
'description': 'BMP file, abitmap format used mostly in theWindows world',
'file_extension': 'bmp',
'hex': '42 4D',
'offset': '0'},
{'ascii': 'BM',
'description': 'BMP file, abitmap format used mostly in theWindows world',
'file_extension': 'dib',
'hex': '42 4D',
'offset': '0'},
{'ascii': 'BM',
'description': 'BMP file, abitmap format used mostly in theWindows world',
'file_extension': 'bmp',
'hex': '42 4D',
'offset': '0'},
{'ascii': 'BM',
'description': 'BMP file, abitmap format used mostly in theWindows world',
'file_extension': 'dib',
'hex': '42 4D',
'offset': '0'},
{'ascii': 'CD001',
'description': 'ISO9660 CD/DVD image file',
'file_extension': 'iso',
'hex': '43 44 30 30 31',
'offset': '0x8001'},
{'ascii': 'CD001',
'description': 'ISO9660 CD/DVD image file',
'file_extension': 'iso',
'hex': '43 44 30 30 31',
'offset': '0x8801'},
{'ascii': 'CD001',
'description': 'ISO9660 CD/DVD image file',
'file_extension': 'iso',
'hex': '43 44 30 30 31',
'offset': '0x9001'},
{'ascii': 'SIMPLE = T',
'description': 'Flexible Image Transport System (FITS)',
'file_extension': 'fits',
'hex': '53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20'
'20 20 20 20 20 20 54',
'offset': '0'},
{'ascii': 'fLaC',
'description': 'Free Lossless Audio Codec',
'file_extension': 'flac',
'hex': '66 4C 61 43',
'offset': '0'},
{'ascii': 'MThd',
'description': 'MIDI sound file',
'file_extension': 'mid',
'hex': '4D 54 68 64',
'offset': '0'},
{'ascii': 'MThd',
'description': 'MIDI sound file',
'file_extension': 'midi',
'hex': '4D 54 68 64',
'offset': '0'},
{'ascii': '',
'description': 'Compound File Binary Format, a container format used for '
'document by older versions ofMicrosoft Office.It is however '
'an open format used by other programs as well.',
'file_extension': 'doc',
'hex': 'D0 CF 11 E0 A1 B1 1A E1',
'offset': ''},
{'ascii': '',
'description': 'Compound File Binary Format, a container format used for '
'document by older versions ofMicrosoft Office.It is however '
'an open format used by other programs as well.',
'file_extension': 'xls',
'hex': 'D0 CF 11 E0 A1 B1 1A E1',
'offset': ''},
{'ascii': '',
'description': 'Compound File Binary Format, a container format used for '
'document by older versions ofMicrosoft Office.It is however '
'an open format used by other programs as well.',
'file_extension': 'ppt',
'hex': 'D0 CF 11 E0 A1 B1 1A E1',
'offset': ''},
{'ascii': '',
'description': 'Compound File Binary Format, a container format used for '
'document by older versions ofMicrosoft Office.It is however '
'an open format used by other programs as well.',
'file_extension': 'msg',
'hex': 'D0 CF 11 E0 A1 B1 1A E1',
'offset': ''},
{'ascii': 'dex.035.',
'description': 'Dalvik Executable',
'file_extension': 'dex',
'hex': '64 65 78 0A 30 33 35 00',
'offset': '0'},
{'ascii': 'KDM',
'description': 'VMDK files',
'file_extension': 'vmdk',
'hex': '4B 44 4D',
'offset': '0'},
{'ascii': 'Cr24',
'description': 'Google Chrome extensionor packaged app',
'file_extension': 'crx',
'hex': '43 72 32 34',
'offset': '0'},
{'ascii': 'AGD3',
'description': 'FreeHand 8 document',
'file_extension': 'fh8',
'hex': '41 47 44 33',
'offset': '0'},
{'ascii': '....BOBO ........ ....',
'description': 'AppleWorks 5 document',
'file_extension': 'cwk',
'hex': '05 07 00 00 42 4F 42 4F 05 07 00 00 00 00 00 00 00 00 00 00 00 01',
'offset': '0'},
{'ascii': '....BOBO ........ ....',
'description': 'AppleWorks 6 document',
'file_extension': 'cwk',
'hex': '06 07 E1 00 42 4F 42 4F 06 07 E1 00 00 00 00 00 00 00 00 00 00 01',
'offset': '0'},
{'ascii': 'ER....ãER....',
'description': 'RoxioToast disc image file, also some .dmg-files begin with '
'same bytes',
'file_extension': 'toast',
'hex': '45 52 02 00 00 00 8B 45 52 02 00 00 00',
'offset': '0'},
{'ascii': 'x.s.bb`',
'description': 'Apple Disk Image file',
'file_extension': 'dmg',
'hex': '78 01 73 0D 62 62 60',
'offset': '0'},
{'ascii': 'xar!',
'description': 'eXtensible Archive format',
'file_extension': 'xar',
'hex': '78 61 72 21',
'offset': '0'},
{'ascii': 'PMOCCMOC',
'description': 'Windows Files And Settings Transfer Repository, See also USMT '
'3.0 (Win XP) and USMT 4.0 (Win 7) User Guides',
'file_extension': 'dat',
'hex': '50 4D 4F 43 43 4D 4F 43',
'offset': '0'},
{'ascii': 'NES',
'description': 'Nintendo Entertainment System ROM file',
'file_extension': 'nes',
'hex': '4E 45 53 1A',
'offset': '0'},
{'ascii': 'ustar.00ustar .',
'description': 'tar archive',
'file_extension': 'tar',
'hex': '75 73 74 61 72 00 30 30 75 73 74 61 72 20 20 00',
'offset': '0x101'},
{'ascii': 'TOX',
'description': 'Open source portable voxel file',
'file_extension': 'tox',
'hex': '74 6F 78 33',
'offset': '0'},
{'ascii': 'MLVI',
'description': 'Magic Lantern Video file',
'file_extension': 'MLV',
'hex': '4D 4C 56 49',
'offset': '0'},
{'ascii': 'DCM PA30',
'description': 'Windows UpdateBinary Delta Compression',
'file_extension': '',
'hex': '44 43 4D 01 50 41 33 30',
'offset': '0'},
{'ascii': "7z¼¯'",
'description': '7-Zip File Format',
'file_extension': '7z',
'hex': '37 7A BC AF 27 1C',
'offset': '0'},
{'ascii': '..',
'description': 'GZIP',
'file_extension': 'gz',
'hex': '1F 8B',
'offset': '0'},
{'ascii': '..',
'description': 'GZIP',
'file_extension': 'tar.gz',
'hex': '1F 8B',
'offset': '0'},
{'ascii': '."M.',
'description': 'LZ4 Frame Format, LZ4 block format does not offer any magic '
'bytes.',
'file_extension': 'lz4',
'hex': '04 22 4D 18',
'offset': '0'},
{'ascii': 'MSCF',
'description': 'Microsoft Cabinet file',
'file_extension': 'cab',
'hex': '4D 53 43 46',
'offset': '0'},
{'ascii': 'FLIF',
'description': 'Free Lossless Image Format',
'file_extension': 'flif',
'hex': '46 4C 49 46',
'offset': '0'},
{'ascii': '.Eߣ',
'description': 'Matroska media container, includingWebM',
'file_extension': 'mkv',
'hex': '1A 45 DF A3',
'offset': '0'},
{'ascii': '.Eߣ',
'description': 'Matroska media container, includingWebM',
'file_extension': 'mka',
'hex': '1A 45 DF A3',
'offset': '0'},
{'ascii': '.Eߣ',
'description': 'Matroska media container, includingWebM',
'file_extension': 'mks',
'hex': '1A 45 DF A3',
'offset': '0'},
{'ascii': '.Eߣ',
'description': 'Matroska media container, includingWebM',
'file_extension': 'mk3d',
'hex': '1A 45 DF A3',
'offset': '0'},
{'ascii': '.Eߣ',
'description': 'Matroska media container, includingWebM',
'file_extension': 'webm',
'hex': '1A 45 DF A3',
'offset': '0'},
{'ascii': 'MIL',
'description': '"SEAN\xa0: Session Analysis" Training file. Also used in '
'compatible software "Rpw\xa0:Rowperfect for Windows" and '
'"RP3W\xa0: ROWPERFECT3 for Windows".',
'file_extension': 'stg',
'hex': '4D 49 4C 20',
'offset': '0'},
{'ascii': 'AT&TFORM....DJV',
'description': 'DjVu document. The following byte is either55 (U) for '
'single-page or4D (M) for multi-page documents.',
'file_extension': "['djvu', 'djv']",
'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
'offset': '0'},
{'ascii': 'AT&TFORM....DJV',
'description': 'DjVu document. The following byte is either55 (U) for '
'single-page or4D (M) for multi-page documents.',
'file_extension': 'djvu',
'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
'offset': '0'},
{'ascii': 'AT&TFORM....DJV',
'description': 'DjVu document. The following byte is either55 (U) for '
'single-page or4D (M) for multi-page documents.',
'file_extension': 'djv',
'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
'offset': '0'},
{'ascii': '0.',
'description': 'DER encoded X.509 certificate',
'file_extension': 'der',
'hex': '30 82',
'offset': '0'},
{'ascii': 'DICM',
'description': 'DICOM Medical File Format',
'file_extension': 'dcm',
'hex': '44 49 43 4D',
'offset': '0x80'},
{'ascii': 'wOFF',
'description': 'WOFF File Format 1.0',
'file_extension': 'woff',
'hex': '77 4F 46 46',
'offset': '0'},
{'ascii': 'wOF2',
'description': 'WOFF File Format 2.0',
'file_extension': 'woff2',
'hex': '77 4F 46 32',
'offset': '0'},
{'ascii': '<?xml',
'description': 'eXtensible Markup Language when using theASCII character '
'encoding',
'file_extension': 'XML',
'hex': '3c 3f 78 6d 6c 20',
'offset': '0'},
{'ascii': '\\0asm',
'description': 'WebAssembly binary format',
'file_extension': 'wasm',
'hex': '6d 73 61 00',
'offset': '0'},
{'ascii': '',
'description': 'Lepton compressed JPEG image',
'file_extension': 'lep',
'hex': 'cf 84 01',
'offset': '0'},
{'ascii': 'CWS',
'description': 'flash .swf',
'file_extension': 'swf',
'hex': '43 57 53',
'offset': '0'},
{'ascii': 'EWS',
'description': 'flash .swf',
'file_extension': 'swf',
'hex': '46 57 53',
'offset': '0'},
{'ascii': '!<arch>.',
'description': 'linux deb file',
'file_extension': 'deb',
'hex': '21 3C 61 72 63 68 3E',
'offset': '0'},
{'ascii': 'RIFF....',
'description': 'Google WebP image file',
'file_extension': 'webp',
'hex': '52 49 46 46 nn nn nn nn',
'offset': '0'},
{'ascii': 'WEBP',
'description': '',
'file_extension': '',
'hex': '57 45 42 50',
'offset': ''},
{'ascii': "'..V",
'description': 'U-Boot / uImage.Das_U-Boot Universal Boot Loader.',
'file_extension': '',
'hex': '27 05 19 56',
'offset': '0'}]