What is a .dat file? (It depends, and here's how to find out)

DAT is not a format. It is a label programs use for 'data', which is why a .dat file can be an email attachment, a Windows registry hive, a video or a game save. How to tell which one you have.

how-todetectionfiles

Most extensions point at a format: .pdf is a PDF, .png is a PNG. .dat points at nothing. It is short for “data”, and programs have used it for decades as a generic name for whatever they needed to store. There is no DAT specification, no DAT application, and no single answer to “how do I open a .dat file”.

There is a reliable way to find out what yours is, though, and in practice almost every .dat people ask about is one of five things.

Step one: look at the bytes

Since the extension is meaningless, the content is the only evidence. Drop the file on the detector for an answer in a second, without uploading it, or look at the first bytes yourself:

# macOS and Linux
file mystery.dat
xxd -l 16 mystery.dat

# Windows PowerShell
Format-Hex -Path .\mystery.dat -Count 16

Then match what you see:

First bytes ASCII What it is
78 9F 3E 22 x.>" winmail.dat, an Outlook email attachment bundle
72 65 67 66 regf A Windows registry hive, such as NTUSER.DAT
52 49 46 46 .. .. .. .. 43 44 58 41 RIFF....CDXA Video CD video
53 51 4C 69 74 65 SQLite An SQLite database
readable text from the first byte Text, CSV or configuration
anything else Almost certainly application data (see below)

winmail.dat: the email attachment you can’t open

By far the most common .dat question. Someone sends you an email with attachments, and what arrives is a single winmail.dat with nothing else.

It is a TNEF file (Transport Neutral Encapsulation Format), Microsoft’s wrapper for Outlook’s rich-text message format. When an Outlook user sends a message formatted as Rich Text to someone whose mail client is not Outlook, Outlook bundles the formatting and the attachments into this one file. Apple Mail, Gmail, Thunderbird and phone mail apps do not unpack it, so the attachments appear to be missing. They are inside.

To get the attachments out:

  • macOS: the free Letter Opener or TNEF’s Enough apps unpack it.
  • Windows: Winmail Opener (free) does the same.
  • Linux and macOS terminal: the tnef utility, in every package manager.
tnef --list winmail.dat     # see what's inside
tnef winmail.dat            # extract into the current folder

Web-based decoders exist too, but they require uploading the email’s attachments to a stranger’s server; fine for a lunch menu, not for a contract.

To stop it happening: the fix is on the sender’s side. In Outlook, under File, Options, Mail, they set Compose messages in this format to HTML and, under Message format, choose to convert Rich Text messages to HTML when sending to Internet recipients. If only one recipient is affected, the sender can open that contact’s email address properties and set Internet format to plain text. Exchange administrators can disable TNEF for external recipients entirely.

NTUSER.DAT: don’t touch

Every Windows user profile has a hidden NTUSER.DAT in C:\Users\<name>\. It is that user’s registry hive: their settings, file associations, recent files, application preferences and more, loaded into the registry at sign-in. The regf signature at the start identifies it, along with siblings like UsrClass.dat.

It is not junk, it is not a virus, and it is not something to open. Deleting it destroys the profile’s settings; Windows will refuse while you are signed in, which is for the best. If you need to read one (for forensics, or to recover settings from an old drive), the Registry Editor can load it under File, Load Hive, and tools such as Registry Explorer read it offline. See the registry guide for the structure.

Video CD files: AVSEQ01.DAT

Found a disc or a folder with MPEGAV/AVSEQ01.DAT? That is a Video CD, the pre-DVD format popular in Asia in the late 1990s and 2000s. The .dat file holds MPEG-1 video wrapped in a RIFF container with the brand CDXA.

VLC plays it directly. To convert it to something modern:

ffmpeg -i AVSEQ01.DAT -c:v libx264 -crf 20 -c:a aac video.mp4

The quality will be what it was in 1998: roughly VHS resolution. Upscaling does not add detail that was never recorded.

Text and CSV data

Plenty of programs write plain text with a .dat extension: scientific instruments, older accounting software, GPS loggers, exported tables, game mods, configuration. If the hex dump shows readable characters from the very first byte, open it in any text editor. If it has commas or tabs in regular columns, rename a copy to .csv and open it in a spreadsheet.

Check the encoding if accented characters look wrong; older Windows software often wrote Windows-1252 rather than UTF-8, and a good editor (VS Code, Notepad++) can reopen with the right encoding.

Application data: leave it to the application

Everything else is the long tail: game saves and assets, caches, licence files, plugin data, the private storage of whichever program put the file there. These are custom formats with no public documentation, and the only thing that reads them is the program that wrote them. The detector will report something generic or “unknown”, which is the honest answer.

The folder usually tells you more than the file: a .dat in C:\Program Files\SomeGame\ belongs to SomeGame. If you need the contents, look for the program’s own export feature. If you are cleaning up disk space, uninstall the program rather than deleting its data files one by one.

What not to do

Renaming a .dat to .exe, .bat or .js “to see if it runs” is a bad idea on a good day and a security incident on a bad one. If the bytes start with MZ (a Windows executable) or the content looks like a script, and you did not create it, treat it as untrusted. The attachment check applies to .dat files like any other.

The short version

.dat means “data”, nothing more. Look at the first bytes: x.>" is a winmail attachment bundle, regf is a registry hive, RIFF....CDXA is a Video CD, readable text is text. Anything else belongs to the program that made it.

← All posts