.MS_ file signature
A MS Compress archive data file begins with the bytes 53 5A 44 44 88 F0 27 33 (SZDD in ASCII) at the start of the file. The signature is the same whatever the file is named, which is why a renamed or extensionless MSCOMPRESS file is still recognisable.
Known signatures
| Offset | Hex | ASCII |
|---|---|---|
| 0 | 53 5A 44 44 88 F0 27 33SZDD variant from COMPRESS.EXE. | SZDD |
| 0 | 4B 57 41 4A 88 F0 27 D1KWAJ variant. | KWAJ |
MIME type: application/x-mscompress · usual extensions: .ms_
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file.ms_
file file.ms_Windows (PowerShell):
Format-Hex -Path file.ms_ -Count 32If the bytes do not match
A file named .ms_ whose first bytes are something else is not a MSCOMPRESS file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the MSCOMPRESS guide explains what a genuine file should contain.