File signatures
Most binary formats begin with a fixed sequence of bytes, the magic number. It is how the file command, antivirus scanners and our detector know what a file is when the name is missing or wrong.
114 formats with a known signature, grouped by category. Formats that are plain text (JSON, CSV, source code) have none and are not listed here; their guides explain how they are recognised instead.
Media
| Format | Hex | ASCII | Offset |
|---|
| 3GP3GPP multimedia file | 66 74 79 70 33 67 | ftyp3g | 4 |
| SWFSmall Web File | 46 57 53 | FWS | 0 |
Archive
| Format | Hex | ASCII | Offset |
|---|
| ACEACE archive | 2A 2A 41 43 45 2A 2A | **ACE** | 7 |
| BZIPbzip2 compressed data | 42 5A 68 | BZh | 0 |
| CABMicrosoft Cabinet archive data | 4D 53 43 46 | MSCF | 0 |
| DMGApple disk image | 6B 6F 6C 79 | koly | end -512 |
| GZIPgzip compressed data | 1F 8B | | 0 |
| ISOISO 9660 CD-ROM filesystem data | 43 44 30 30 31 | CD001 | 32769 |
| JARJava archive data (JAR) | 50 4B 03 04 | PK.. | 0 |
| LHALHarc archive | 2D 6C 68 | -lh | 2 |
| LZ4LZ4 compressed data | 04 22 4D 18 | | 0 |
| MSCOMPRESSMS Compress archive data | 53 5A 44 44 88 F0 27 33 | SZDD | 0 |
| RARRAR archive data | 52 61 72 21 1A 07 00 | Rar!... | 0 |
| SEVENZIP7-zip archive data | 37 7A BC AF 27 1C | 7z..'. | 0 |
| SQUASHFSSquash filesystem | 68 73 71 73 | hsqs | 0 |
| TARPOSIX tar archive | 75 73 74 61 72 | ustar | 257 |
| XARXAR archive compressed data | 78 61 72 21 | xar! | 0 |
| XPICompressed installation archive (XPI) | 50 4B 03 04 | PK.. | 0 |
| XZXZ compressed data | FD 37 7A 58 5A 00 | .7zXZ. | 0 |
| ZIPZip archive data | 50 4B 03 04 | PK.. | 0 |
| ZLIBSTREAMzlib compressed data | 78 9C | | 0 |
| ZSTZstandard compressed data | 28 B5 2F FD | | 0 |
Image
| Format | Hex | ASCII | Offset |
|---|
| AIAdobe Illustrator Artwork | 25 50 44 46 2D | %PDF- | 0 |
| AVIFAV1 Image File Format | 66 74 79 70 61 76 69 66 | ftypavif | 4 |
| BMPBMP image data | 42 4D | BM | 0 |
| DICOMDICOM | 44 49 43 4D | DICM | 128 |
| EMFWindows Enhanced Metafile image data | 20 45 4D 46 | EMF | 40 |
| GIFGIF image data | 47 49 46 38 39 61 | GIF89a | 0 |
| HEIFHigh Efficiency Image Format | 66 74 79 70 68 65 69 63 | ftypheic | 4 |
| ICNSMac OS X icon | 69 63 6E 73 | icns | 0 |
| ICOMS Windows icon resource | 00 00 01 00 | | 0 |
| JP2jpeg2000 | 00 00 00 0C 6A 50 20 20 0D 0A 87 0A | ....jP .... | 0 |
| JPEGJPEG image data | FF D8 FF | | 0 |
| JXLJPEG XL image | FF 0A | | 0 |
| PNGPNG image data | 89 50 4E 47 0D 0A 1A 0A | .PNG.... | 0 |
| PSDAdobe Photoshop image | 38 42 50 53 | 8BPS | 0 |
| TGATarga image data | 54 52 55 45 56 49 53 49 4F 4E 2D 58 46 49 4C 45 2E 00 | TRUEVISION-XFILE. | end -26 |
| TIFFTIFF image data | 49 49 2A 00 | II*. | 0 |
| WEBPWebP media file | 52 49 46 46 ?? ?? ?? ?? 57 45 42 50 | RIFF....WEBP | 0 |
| WMFWindows metafile | D7 CD C6 9A | | 0 |
| XCFGIMP image | 67 69 6D 70 20 78 63 66 20 | gimp xcf | 0 |
Application
| Format | Hex | ASCII | Offset |
|---|
| APKAndroid package | 50 4B 03 04 | PK.. | 0 |
| CRXGoogle Chrome extension | 43 72 32 34 | Cr24 | 0 |
| MSIMicrosoft Installer | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
Data
| Format | Hex | ASCII | Offset |
|---|
| APPLEBPLISTApple binary property list | 62 70 6C 69 73 74 30 30 | bplist00 | 0 |
| H5Hierarchical Data Format v5 | 89 48 44 46 0D 0A 1A 0A | .HDF.... | 0 |
| NPYNumpy Array | 93 4E 55 4D 50 59 | .NUMPY | 0 |
| NPZNumpy Arrays Archive | 50 4B 03 04 | PK.. | 0 |
| PARQUETApache Parquet | 50 41 52 31 | PAR1 | 0 |
| PCAPpcap capture file | D4 C3 B2 A1 | | 0 |
| PICKLEPython pickle | 80 04 | | 0 |
| PYTORCHPyTorch | 50 4B 03 04 | PK.. | 0 |
| TORRENTBitTorrent file | 64 38 3A 61 6E 6E 6F 75 6E 63 65 | d8:announce | 0 |
Document
| Format | Hex | ASCII | Offset |
|---|
| CHMMS Windows HtmlHelp Data | 49 54 53 46 03 00 00 00 | ITSF | 0 |
| DOCMicrosoft Word CDF document | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
| DOCXMicrosoft Word 2007+ document | 50 4B 03 04 | PK.. | 0 |
| EPUBEPUB document | 50 4B 03 04 | PK.. | 0 |
| HLPMS Windows help | 3F 5F 03 00 | ?_ | 0 |
| ODPOpenDocument Presentation | 50 4B 03 04 | PK.. | 0 |
| ODSOpenDocument Spreadsheet | 50 4B 03 04 | PK.. | 0 |
| ODTOpenDocument Text | 50 4B 03 04 | PK.. | 0 |
| ONEOne Note | E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 | | 0 |
| PDFPDF document | 25 50 44 46 2D | %PDF- | 0 |
| POSTSCRIPTPostScript document | 25 21 50 53 | %!PS | 0 |
| PPTMicrosoft PowerPoint CDF document | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
| PPTXMicrosoft PowerPoint 2007+ document | 50 4B 03 04 | PK.. | 0 |
| PUBMicrosoft Publisher document | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
| RTFRich Text Format document | 7B 5C 72 74 66 31 | {\rtf1 | 0 |
| VISIOMicrosoft Visio drawing | 50 4B 03 04 | PK.. | 0 |
| XLSMicrosoft Excel CDF document | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
| XLSBMicrosoft Excel 2007+ document (binary format) | 50 4B 03 04 | PK.. | 0 |
| XLSXMicrosoft Excel 2007+ document | 50 4B 03 04 | PK.. | 0 |
System
| Format | Hex | ASCII | Offset |
|---|
| CATWindows Catalog file | 30 82 | | 0 |
| DSSTOREApplication Desktop Services Store | 00 00 00 01 42 75 64 31 | ....Bud1 | 0 |
| LNKMS Windows shortcut | 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 | | 0 |
| THUMBSDBWindows thumbnail cache | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
| WINREGISTRYWindows Registry text | 72 65 67 66 | regf | 0 |
Binary
| Format | Hex | ASCII | Offset |
|---|
| COFFIntel 80386 COFF | 64 86 | | 0 |
| DEXDalvik dex file | 64 65 78 0A 30 33 35 00 | dex\n035\0 | 0 |
| ELFELF executable | 7F 45 4C 46 | .ELF | 0 |
| JAVABYTECODEJava compiled bytecode | CA FE BA BE | | 0 |
| MACHOMach-O executable | CF FA ED FE | | 0 |
| PDBWindows Program Database | 4D 69 63 72 6F 73 6F 66 74 20 43 2F 43 2B 2B 20 4D 53 46 20 37 2E 30 30 | Microsoft C/C++ MSF 7.00 | 0 |
| PEBINPE Windows executable | 4D 5A | MZ | 0 |
| PYTHONBYTECODEPython compiled bytecode | ?? ?? 0D 0D 0A | | 0 |
| WASMWeb Assembly | 00 61 73 6D 01 00 00 00 | .asm.... | 0 |
Security
| Format | Hex | ASCII | Offset |
|---|
| CRTCertificates (binary format) | 30 82 | | 0 |
Package
| Format | Hex | ASCII | Offset |
|---|
| DEBDebian binary package | 21 3C 61 72 63 68 3E 0A | !<arch>\n | 0 |
| MSIXMSIX Windows app package | 50 4B 03 04 | PK.. | 0 |
| NUPKGNuGet Package | 50 4B 03 04 | PK.. | 0 |
| RPMRedHat Package Manager archive (RPM) | ED AB EE DB | | 0 |
| SNAPSnap archive | 68 73 71 73 | hsqs | 0 |
CAD
| Format | Hex | ASCII | Offset |
|---|
| 3MF3D Manufacturing Format | 50 4B 03 04 | PK.. | 0 |
| DWGAutocad Drawing | 41 43 31 30 | AC10 | 0 |
Email
| Format | Hex | ASCII | Offset |
|---|
| OUTLOOKMicrosoft Outlook email folder | D0 CF 11 E0 A1 B1 1A E1 | | 0 |
Audio
| Format | Hex | ASCII | Offset |
|---|
| FLACFLAC audio bitstream data | 66 4C 61 43 | fLaC | 0 |
| MIDIMidi | 4D 54 68 64 | MThd | 0 |
| MP3MPEG v1/2 Layer III audio | 49 44 33 | ID3 | 0 |
| OGGOgg data | 4F 67 67 53 | OggS | 0 |
| WAVWaveform Audio file (WAV) | 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 | RIFF....WAVE | 0 |
| WMAWindows Media Audio | 30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C | | 0 |
Video
| Format | Hex | ASCII | Offset |
|---|
| AVIAudio Video Interleave | 52 49 46 46 ?? ?? ?? ?? 41 56 49 20 | RIFF....AVI | 0 |
| FLVFlash Video | 46 4C 56 01 | FLV. | 0 |
| MKVMatroska | 1A 45 DF A3 | | 0 |
| MP4MPEG-4 media file | 66 74 79 70 | ftyp | 4 |
| MPEGTSMPEG transport stream | 47 | | 0 |
| WEBMWebM media file | 1A 45 DF A3 | | 0 |
| WMVWindows Media Video | 30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C | | 0 |
Database
| Format | Hex | ASCII | Offset |
|---|
| SQLITESQLITE database | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | SQLite format 3\0 | 0 |
Font
| Format | Hex | ASCII | Offset |
|---|
| OTFOpenType font | 4F 54 54 4F | OTTO | 0 |
| TTFTrueType Font data | 00 01 00 00 | | 0 |
| WOFFWeb Open Font Format | 77 4F 46 46 | wOFF | 0 |
| WOFF2Web Open Font Format v2 | 77 4F 46 32 | wOF2 | 0 |