File Formats

File Formats#

Reference of common file formats with their magic-byte signatures (file headers used by file(1) and forensic tools to identify types regardless of extension), MIME types, and typical operator-relevant notes.

The file command on Linux + macOS reads /usr/share/file/magic or /etc/magic (compiled to magic.mgc) and reports the detected type. binwalk and foremost use similar signatures for carving from raw images.

Documents#

Format

Magic bytes (hex)

Notes

PDF

25 50 44 46 %PDF

Adobe PDF; “%%EOF” trailer; offsets in xref.

Office Open XML

50 4B 03 04

ZIP container: .docx, .xlsx, .pptx, .ods, .odt.

Microsoft CFBF

D0 CF 11 E0 A1 B1 1A E1

Compound File Binary Format: legacy .doc, .xls, .ppt, .msi, .msg.

RTF

7B 5C 72 74 66 {\rtf

-

PostScript

25 21 50 53 %!PS

-

PS / EPS

25 21 %!

-

Images#

Format

Magic bytes (hex)

Notes

PNG

89 50 4E 47 0D 0A 1A 0A

8-byte signature; chunks (IHDR, IDAT, IEND).

JPEG (JFIF / EXIF)

FF D8 FF E0 (JFIF) / FF D8 FF E1 (EXIF)

Trailer FF D9.

GIF87a / 89a

47 49 46 38 37 61 / 38 39 61

-

BMP

42 4D BM

-

TIFF (LE / BE)

49 49 2A 00 / 4D 4D 00 2A

EXIF tag-based; many variants.

WebP

52 49 46 46 ?? ?? ?? ?? 57 45 42 50

RIFF container.

HEIF / HEIC

00 00 00 ?? 66 74 79 70 68 65 69 63

ftyp box, “heic” brand.

AVIF

00 00 00 ?? 66 74 79 70 61 76 69 66

ftyp box, “avif” brand.

SVG

3C 3F 78 6D 6C / 3C 73 76 67

<?xml / <svg

ICO

00 00 01 00

-

PSD

38 42 50 53 8BPS

-

Audio / video#

Format

Magic bytes (hex)

Notes

MP3 (ID3v2)

49 44 33 ID3

Then 0xFF 0xFB sync.

MP3 (no ID3)

FF FB / FF F3 / FF F2

Frame sync.

WAV

52 49 46 46 ?? ?? ?? ?? 57 41 56 45

RIFF “WAVE”.

FLAC

66 4C 61 43 fLaC

-

OGG

4F 67 67 53 OggS

Vorbis / Opus / Theora.

M4A / AAC

00 00 00 ?? 66 74 79 70 4D 34 41 20

ftyp “M4A “.

MIDI

4D 54 68 64 MThd

-

MP4 / MOV / 3GP

00 00 00 ?? 66 74 79 70

ftyp box; brand identifies sub-format.

MKV / WebM

1A 45 DF A3

Matroska EBML.

AVI

52 49 46 46 ?? ?? ?? ?? 41 56 49 20

RIFF “AVI “.

ASF / WMV / WMA

30 26 B2 75 8E 66 CF 11

-

Archives#

Format

Magic bytes (hex)

Notes

ZIP

50 4B 03 04 / 50 4B 05 06 (empty) / 50 4B 07 08 (spanned)

PK\x03\x04; OOXML / JAR / APK / EPUB are ZIPs.

GZIP

1F 8B 08

-

BZIP2

42 5A 68 BZh

-

XZ

FD 37 7A 58 5A 00

-

LZ4

04 22 4D 18

-

Zstandard

28 B5 2F FD

-

RAR (1.5+)

52 61 72 21 1A 07 00

-

RAR (5+)

52 61 72 21 1A 07 01 00

-

7-Zip

37 7A BC AF 27 1C

-

TAR (POSIX ustar)

75 73 74 61 72 ustar at offset 257

-

ARJ

60 EA

-

LZH

-lh0- / -lz0- (5 chars at offset 2)

-

ISO 9660

43 44 30 30 31 CD001 at offset 32769

-

EAR / WAR / JAR

50 4B 03 04

ZIP-based.

Executables#

Format

Magic bytes (hex)

Notes

Windows PE

4D 5A MZ

COFF; e_lfanew points to PE header.

ELF

7F 45 4C 46 \x7fELF

Linux / BSD / Solaris.

Mach-O 32 LE

CE FA ED FE / FE ED FA CE

-

Mach-O 64 LE

CF FA ED FE / FE ED FA CF

-

Mach-O Fat (Univ.)

CA FE BA BE / BE BA FE CA

“FAT”; multi-arch container.

Java class

CA FE BA BE

Same first 4 bytes as Mach-O Fat (disambiguate via length).

WebAssembly

00 61 73 6D \0asm

-

DEX (Android)

64 65 78 0A 30 33 35 00 dex.035\0

-

.NET Assembly

4D 5A … PE32 with CLR header

-

EFI / PE+

4D 5A MZ -> PE32+

-

DOS COM

(no magic; loaded at CS:0100)

-

Bash script

23 21 2F #!/ (shebang)

-

Python (.pyc 3.11)

CB 0D 0D 0A

-

Filesystems#

FS

Magic / superblock

Notes

ext2 / ext3 / ext4

53 EF at offset 1080 (super)

Linux native.

NTFS

EB 52 90 4E 54 46 53 20 20 20 20

Windows native.

FAT12 / FAT16

55 AA at offset 510

MBR boot sector signature.

FAT32

41 41 55 AA at offsets 0x1FE / 0x200

Boot sector.

exFAT

EB 76 90 EXFAT

-

HFS+

48 2B / 48 58 H+

Apple HFS+.

APFS

NXSB at offset 32

Apple File System (modern macOS).

ISO 9660

CD001 at offset 32769

Optical disc / image.

UDF

BEA01 at offset 32768

Optical / Blu-ray.

SquashFS

68 73 71 73

Compressed read-only Linux FS.

Btrfs

5F 42 48 52 66 53 5F 4D

at offset 0x10040.

ZFS

0C B1 BA 00

“ZBOC”.

LUKS

4C 55 4B 53 BA BE LUKS\xba\xbe

Encrypted disk header.

VHD / VHDX

63 6F 6E 65 63 74 69 78 conectix

Virtual hard disk.

VMDK

4B 44 4D KDM

-

QCOW

51 46 49 FB QFI\xfb

-

Network captures#

Format

Magic

Notes

PCAP (classic)

D4 C3 B2 A1 (LE) / A1 B2 C3 D4 (BE)

libpcap / tcpdump.

PCAP-NG

0A 0D 0D 0A

Modern multi-interface.

ETL (Windows)

45 56 4E 54

Windows event-trace log.

Snoop (Solaris)

73 6E 6F 6F 70

“snoop”.

Data formats#

Format

Notes

-

JSON

Plain text; no magic.

-

JSON Lines (ndjson)

one JSON value per line.

-

YAML

Plain text; %YAML directive optional.

-

TOML

Plain text.

-

CSV / TSV

Plain text; magic-by-content.

-

XML

<?xml (3C 3F 78 6D 6C).

-

HTML

<!DOCTYPE or <html>.

-

Parquet

PAR1 (50 41 52 31) at start AND end.

-

Avro

4F 62 6A 01 Obj\x01

-

ORC

4F 52 43 17 ORC\x17

-

HDF5

89 48 44 46 0D 0A 1A 0A \x89HDF\r\n...

-

Feather / Arrow IPC

41 52 52 4F 57 31 ARROW1

-

SQLite

53 51 4C 69 74 65 20 66 6F 72 6D 61 74

SQLite format 3

LevelDB

ldb segments per file.

-

RocksDB

segments per file.

-

Parquet (modular)

columnar; PAR1 markers.

-

Protobuf wire

no magic; varint type+length.

-

MsgPack

no fixed magic; per-type tag.

-

Mail / message#

Format

Notes

-

mbox

From line at start of each message.

-

Maildir

one file per message in cur/new/tmp.

-

PST

21 42 44 4E !BDN

Outlook.

OST

21 42 44 4E !BDN

Outlook offline.

EML / MSG (RFC 5322

) plain headers + body.

-

PEM

—–BEGIN …—–

Cert / key.

DER

ASN.1 binary; no fixed magic.

-

Authorization / certs#

Format

Notes

-

PEM

-----BEGIN CERTIFICATE----- etc.

-

DER

ASN.1 binary; X.509, CRL, CSR.

-

PKCS#7

.p7b / .p7c.

-

PKCS#8

.p8 / .key.

-

PKCS#12

.p12 / .pfx (DER-encoded; password-protected

).

JWK

JSON Web Key.

-

SSH (OpenSSH key)

-----BEGIN OPENSSH PRIVATE KEY-----

-

SSH (RSA / DSA)

-----BEGIN RSA PRIVATE KEY----- etc.

-

GPG ASCII-armored

-----BEGIN PGP MESSAGE----- etc.

-

GPG binary

99 / 95 type-tag at start.

-

Forensic / specialty#

Format

Notes

-

EnCase E01 / Ex01

45 56 46 09 0D 0A FF 00 EVF\x09\r\n\xff\x00

Forensic image.

AFF

41 46 46 AFF

Advanced Forensic Format.

Raw / dd

no magic; full disk image.

-

Volatility VMEM

no magic; raw memory.

-

PCAPng

0A 0D 0D 0A

Capture format (above).

Tooling#

Tool

Notes

file

POSIX; magic-database driven.

binwalk

recursive carving + entropy analysis.

foremost

carving by header / footer.

scalpel

carving fork.

trid

trIDscan; rich identifier database.

yara

pattern matching; can encode “is this format?”.

mediainfo

rich audio / video metadata.

exiftool

metadata for nearly every format.

magika

Google ML-based file-type identifier (2024+).

hexdump / xxd

raw byte inspection.

hachoir

structured parsing of many formats.

Kaitai Struct

declarative format-parser DSL.

010 Editor

commercial hex editor with templates.

ImHex

OSS hex editor with patterns.

Operator notes#

  • Magic bytes ≠ ground truth, attackers tamper headers, use polyglot files (valid in multiple formats), or strip magic. Use multiple identifiers (file + binwalk + entropy).

  • Polyglots, a single file can be valid PDF + JAR + ZIP + GIF; routine in CTF and exploit work.

  • Containers, ZIP-based formats (.docx, .jar, .apk, .epub) all share the PKx03x04 magic; check the inner layout (mimetype file in EPUB, AndroidManifest in APK).

  • Header-only signatures fail for streamed protocols and archive carving; check trailers + cross-format constraints.

  • Encrypted containers (LUKS, VeraCrypt, BitLocker) have recognisable headers but no content fingerprint without the key.

  • Magika (Google, 2024) uses a small CNN; better than rule-based on adversarial inputs.

References#

Contents