Skip to main content

A python library for identifying files by headers (magic bytes)

Project description

A python library for identifying files by headers (magic bytes)

based on info from: ‘Wikipedia - List of file signatures’

Still alpha, but code should be easy enough to follow and expand upon.

Example use:

# returns a Match object (list of signatures) that match the file 'f'
with open(f_name, "rb") as f:
    derp = get_from_file(f)

# returns Match object (list of signatures) that match the file at this file path
herp = get_from_path(f_name)

# this can be a string or a bytestring, will raise exception if no matching headers found.
Matches(header="%PDF")

file_signatures.compare(header, test_hex_string)

A method that compares a two file headers, the first one directly read from a file, the second is a a string containing space delimited hexidecimal byte codes. its a string becuase ‘nn’ is used to represent a wildcard byte.

test_hex_string

This is the string of space delimited hexidecimal byte codes representing the file signature.

‘nn’ is used to represent a wildcard byte

example:

# for example, "%PDF"
test_hex_string = "25 50 44 46"

# showing wildcards, %P**DF
test_hex_string = "25 50 nn nn 44 46"

get_from_file(f, max_header=32)

Return a Match object of all the matching Signatures for this file

f

‘f’ is the open file object.

Note: you can use textIO to get a file like object from a string

max_header

This is the length in bytes read from the start of the file used as the file header.

get_from_path(path, max_header=32)

Return a Match object of all the matching signatures for this file, using the path rather than a file object now.

path

‘path’ is the path to a file, it is passed into open() so it can be relative if you like.

max_header

This is the length in bytes read from the start of the file used as the file header.

file_signatures.Signature

A class that reimplements a dictionary. These are initialised and returned as part of the Match class when a Byte signature is tested using the file_signatures.compare() function.

file_extension

A suggested file extension for this type of file

description

A brief description of the file type taken from ‘List of file signatures’.

offset

Not implemented yet…

ascii

ASCII interpretation of the file signature eg. ‘%PDF’

hex

The space delimited hexidecimal byte codes representing the file signature.

example:

# for example, "%PDF"
test_hex_string = "25 50 44 46"

(see above test_hex_string)

file_signatures.Match

This is a list reimplemented, it is returned by get_from_file and get_from_path defs. It holds a list Signature objects.

file_signatures.NoMatchException

This is a basic exception used when a match cannot be found.

Use try: except: statements in your code if you dont like this.

file_signatures.signatures

a list of dictionary items representing a file signature class. Used to check against and initialise new Signatures.

example:

# example entry from file_signatures.signatures list
{'ascii': 'v/1.',
 'description': 'OpenEXR image',
 'file_extension': 'exr',
 'hex': '76 2F 31 01',
 'offset': '0'}

Current List

# Wikipedia License
# -----------------
#
# This Library uses material from the Wikipedia article
# https://en.wikipedia.org/wiki/List_of_file_signatures, which is released
# under the Creative Commons Attribution-Share-Alike License 3.0


signatures = [{'ascii': '....',
               'description': 'RedHat Package Manager (RPM) package',
               'file_extension': 'rpm',
               'hex': 'ed ab ee db',
               'offset': '0'},
              {'ascii': 'SP01',
               'description': 'Amazon Kindle Update Package',
               'file_extension': 'bin',
               'hex': '53 50 30 31',
               'offset': '0'},
              {'ascii': '.',
               'description': 'WindowsProgram Information File',
               'file_extension': 'PIF',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'MacStuffit Self-Extracting Archive',
               'file_extension': 'SEA',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'IRISOCR data file',
               'file_extension': 'YTR',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'IBM Storyboard bitmap file',
               'file_extension': 'PIC',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '........ ........ ........',
               'description': 'PalmPilot Database/Document File',
               'file_extension': 'PDB',
               'hex': '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
               '00',
                      'offset': '11'},
              {'ascii': '...',
               'description': 'Palm Desktop Calendar Archive',
               'file_extension': 'DBA',
               'hex': 'BE BA FE CA',
               'offset': '0'},
              {'ascii': '..BD',
               'description': 'Palm Desktop To Do Archive',
               'file_extension': 'DBA',
               'hex': '00 01 42 44',
               'offset': '0'},
              {'ascii': '..DT',
               'description': 'Palm Desktop Calendar Archive',
               'file_extension': 'TDA',
               'hex': '00 01 44 54',
               'offset': '0'},
              {'ascii': '...',
               'description': 'Palm Desktop Data File (Access format)',
               'file_extension': '',
               'hex': '00 01 00 00',
               'offset': '0'},
              {'ascii': '....',
               'description': 'Computer icon encoded inICO file format',
               'file_extension': 'ico',
               'hex': '00 00 01 00',
               'offset': '0'},
              {'ascii': 'ftyp 3g',
               'description': '3rd Generation Partnership Project3GPP',
               'file_extension': '3gp',
               'hex': '66 74 79 70 33 67',
               'offset': '4'},
              {'ascii': 'ftyp 3g',
               'description': '3GPP2 multimedia files',
               'file_extension': '3g2',
               'hex': '66 74 79 70 33 67',
               'offset': '4'},
              {'ascii': '..',
               'description': 'compressed file (often tar zip)',
               'file_extension': 'z',
               'hex': '1F 9D',
               'offset': '0'},
              {'ascii': '..',
               'description': 'usingLempel-Ziv-Welch algorithm',
               'file_extension': 'tar.z',
               'hex': '1F 9D',
               'offset': '0'},
              {'ascii': '..',
               'description': 'Compressed file (often tar zip)',
               'file_extension': 'z',
               'hex': '1F A0',
               'offset': '0'},
              {'ascii': '..',
               'description': 'usingLZH algorithm',
               'file_extension': 'tar.z',
               'hex': '1F A0',
               'offset': '0'},
              {'ascii': 'BACKMIKE DISK',
               'description': 'File ortape containing abackup done withAmiBack on an Amiga. '
               'It typically is paired with an index file (idx) with the '
                              'table of contents.',
                              'file_extension': 'bac',
               'hex': '42 41 43 4B 4D 49 4B 45 44 49 53 4B',
               'offset': '0'},
              {'ascii': 'BZh',
               'description': 'Compressed file usingBzip2 algorithm',
               'file_extension': 'bz2',
               'hex': '42 5A 68',
               'offset': '0'},
              {'ascii': 'GIF87aGIF89a',
               'description': 'Image file encoded in theGraphics Interchange Format (GIF)',
               'file_extension': 'gif',
               'hex': '47 49 46 38 37 61 47 49 46 38 39 61',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (little endian format)',
               'file_extension': 'tif',
               'hex': '49 49 2A 00',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (little endian format)',
               'file_extension': 'tiff',
               'hex': '49 49 2A 00',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (big endian format)',
               'file_extension': 'tif',
               'hex': '4D 4D 00 2A',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (big endian format)',
               'file_extension': 'tiff',
               'hex': '4D 4D 00 2A',
               'offset': '0'},
              {'ascii': 'II*..... CR',
               'description': "Canon's RAW format is based on the TIFF file format",
               'file_extension': 'cr2',
               'hex': '49 49 2A 00 10 00 00 00 43 52',
               'offset': '0'},
              {'ascii': 'II*..... CR',
               'description': 'Canon RAW Format Version 2',
               'file_extension': 'cr2',
               'hex': '49 49 2A 00 10 00 00 00 43 52',
               'offset': '0'},
              {'ascii': '.*_.',
               'description': 'KodakCineon image',
               'file_extension': 'cin',
               'hex': '80 2A 5F D7',
               'offset': '0'},
              {'ascii': 'RNC.',
               'description': 'Compressed file usingRob Northen Compression (version 1 and '
               '2) algorithm',
                              'file_extension': '',
               'hex': '52 4E 43 01 52 4E 43 02',
               'offset': '0'},
              {'ascii': 'SDPXXPDS',
               'description': 'SMPTEDPX image (big endian format)',
               'file_extension': 'dpx',
               'hex': '53 44 50 58',
               'offset': '0'},
              {'ascii': 'SDPXXPDS',
               'description': 'SMPTEDPX image (little endian format)',
               'file_extension': 'dpx',
               'hex': '58 50 44 53',
               'offset': '0'},
              {'ascii': 'v/1.',
               'description': 'OpenEXR image',
               'file_extension': 'exr',
               'hex': '76 2F 31 01',
               'offset': '0'},
              {'ascii': 'BPGû',
               'description': 'Better Portable Graphics format',
               'file_extension': 'bpg',
               'hex': '42 50 47 FB',
               'offset': '0'},
              {'ascii': 'ÿØÿÛ',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF DB',
               'offset': '0'},
              {'ascii': 'ÿØÿÛ',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF DB',
               'offset': '0'},
              {'ascii': 'ÿØÿà ..J F IF..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
               'offset': '0'},
              {'ascii': 'ÿØÿà ..J F IF..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
               'offset': '0'},
              {'ascii': 'ÿØÿá ..E x if..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
               'offset': '0'},
              {'ascii': 'ÿØÿá ..E x if..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
               'offset': '0'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'ilbm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'lbm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'ibm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': '8svx',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': '8sv',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'svx',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'snd',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... ACBM',
               'description': 'Amiga Contiguous Bitmap',
               'file_extension': 'acbm',
               'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ACBM',
               'description': 'Amiga Contiguous Bitmap',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANBM',
               'description': 'IFFAnimated Bitmap',
               'file_extension': 'anbm',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANBM',
               'description': 'IFFAnimated Bitmap',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANIM',
               'description': 'IFFCEL Animation',
               'file_extension': 'anim',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANIM',
               'description': 'IFFCEL Animation',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'faxx',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'faxx',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'ftxt',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'txt',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'smus',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'smu',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'mus',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'cmus',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'mus',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'yuvn',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'yuv',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... FANT',
               'description': 'AmigaFantavision Movie',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 4E 54',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aiff',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aif',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aifc',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'snd',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'INDX',
               'description': 'Index file to a file ortape containing abackup done '
               'withAmiBack on anAmiga.',
                              'file_extension': 'idx',
               'hex': '49 4E 44 58',
               'offset': '0'},
              {'ascii': 'LZIP',
               'description': 'lzip compressed file',
               'file_extension': 'lz',
               'hex': '4C 5A 49 50',
               'offset': '0'},
              {'ascii': 'MZ',
               'description': 'DOS MZ executable file format and its descendants '
               '(includingNE andPE)',
                              'file_extension': 'exe',
               'hex': '4D 5A',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'zip',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'jar',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'odt',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'ods',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'odp',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'docx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'xlsx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'pptx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'vsdx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'apk',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'zip',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'jar',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'odt',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'ods',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'odp',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'docx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'xlsx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'pptx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'vsdx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'apk',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'zip',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'jar',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'odt',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'ods',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'odp',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'docx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'xlsx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'pptx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'vsdx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'apk',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'Rar!...',
               'description': 'RAR archive version 1.50 onwards',
               'file_extension': 'rar',
               'hex': '52 61 72 21 1A 07 00',
               'offset': '0'},
              {'ascii': 'Rar!....',
               'description': 'RAR archive version 5.0 onwards',
               'file_extension': 'rar',
               'hex': '52 61 72 21 1A 07 01 00',
               'offset': '0'},
              {'ascii': '.ELF',
               'description': 'Executable and Linkable Format',
               'file_extension': '',
               'hex': '7F 45 4C 46',
               'offset': '0'},
              {'ascii': '.PNG....',
               'description': 'Image encoded in thePortable Network Graphics format',
               'file_extension': 'png',
               'hex': '89 50 4E 47 0D 0A 1A 0A',
               'offset': '0'},
              {'ascii': 'Êþº¾',
               'description': 'Java class file,Mach-O Fat Binary',
               'file_extension': 'class',
               'hex': 'CA FE BA BE',
               'offset': '0'},
              {'ascii': '',
               'description': 'UTF-8 encodedUnicodebyte order mark, commonly seen in text '
               'files.',
                              'file_extension': '',
               'hex': 'EF BB BF',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (32-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CE',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (32-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CE',
               'offset': '0x1000'},
              {'ascii': '........',
               'description': 'Mach-O binary (64-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CF',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (64-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CF',
               'offset': '0x1000'},
              {'ascii': '........',
               'description': 'Mach-O binary (reverse byte ordering scheme, 32-bit)',
               'file_extension': '',
               'hex': 'CE FA ED FE',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (reverse byte ordering scheme, 64-bit)',
               'file_extension': '',
               'hex': 'CF FA ED FE',
               'offset': '0'},
              {'ascii': '..',
               'description': 'Byte-order mark for text file encoded inlittle-endian16-bit '
               'Unicode Transfer Format',
                              'file_extension': '',
               'hex': 'FF FE',
               'offset': '0'},
              {'ascii': '....',
               'description': 'Byte-order mark for text file encoded in little-endian32-bit '
               'Unicode Transfer Format',
                              'file_extension': '',
               'hex': 'FF FE 00 00',
               'offset': '0'},
              {'ascii': '%!PS',
               'description': 'PostScript document',
               'file_extension': 'ps',
               'hex': '25 21 50 53',
               'offset': '0'},
              {'ascii': '%PDF',
               'description': 'PDF document',
               'file_extension': 'pdf',
               'hex': '25 50 44 46',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'asf',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'wma',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'wmv',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '$SDI0001',
               'description': 'System Deployment Image, a disk image format used byMicrosoft',
               'file_extension': '',
               'hex': '24 53 44 49 30 30 30 31',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'ogg',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'oga',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'ogv',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': '8BPS',
               'description': "Photoshop Document file,Adobe Photoshop's native file format",
               'file_extension': 'psd',
               'hex': '38 42 50 53',
               'offset': '0'},
              {'ascii': 'RIFF.... WAVE',
               'description': 'Waveform Audio File Format',
               'file_extension': 'wav',
               'hex': '52 49 46 46 nn nn nn nn 57 41 56 45',
               'offset': '0'},
              {'ascii': 'RIFF.... AVI.',
               'description': 'Audio Video Interleave video format',
               'file_extension': 'avi',
               'hex': '52 49 46 46 nn nn nn nn 41 56 49 20',
               'offset': '0'},
              {'ascii': 'ÿû',
               'description': 'MPEG-1 Layer 3 file without anID3 tag or with anID3v1 tag '
               "(which's appended at the end of the file)",
                              'file_extension': 'mp3',
               'hex': 'FF FB',
               'offset': '0'},
              {'ascii': 'ID3',
               'description': 'MP3 file with an ID3v2 container',
               'file_extension': 'mp3',
               'hex': '49 44 33',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'bmp',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'dib',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'bmp',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'dib',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x8001'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x8801'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x9001'},
              {'ascii': 'SIMPLE   =         T',
               'description': 'Flexible Image Transport System (FITS)',
               'file_extension': 'fits',
               'hex': '53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20'
               '20 20 20 20 20 20 54',
                      'offset': '0'},
              {'ascii': 'fLaC',
               'description': 'Free Lossless Audio Codec',
               'file_extension': 'flac',
               'hex': '66 4C 61 43',
               'offset': '0'},
              {'ascii': 'MThd',
               'description': 'MIDI sound file',
               'file_extension': 'mid',
               'hex': '4D 54 68 64',
               'offset': '0'},
              {'ascii': 'MThd',
               'description': 'MIDI sound file',
               'file_extension': 'midi',
               'hex': '4D 54 68 64',
               'offset': '0'},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'doc',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'xls',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'ppt',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'msg',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': 'dex.035.',
               'description': 'Dalvik Executable',
               'file_extension': 'dex',
               'hex': '64 65 78 0A 30 33 35 00',
               'offset': '0'},
              {'ascii': 'KDM',
               'description': 'VMDK files',
               'file_extension': 'vmdk',
               'hex': '4B 44 4D',
               'offset': '0'},
              {'ascii': 'Cr24',
               'description': 'Google Chrome extensionor packaged app',
               'file_extension': 'crx',
               'hex': '43 72 32 34',
               'offset': '0'},
              {'ascii': 'AGD3',
               'description': 'FreeHand 8 document',
               'file_extension': 'fh8',
               'hex': '41 47 44 33',
               'offset': '0'},
              {'ascii': '....BOBO ........ ....',
               'description': 'AppleWorks 5 document',
               'file_extension': 'cwk',
               'hex': '05 07 00 00 42 4F 42 4F 05 07 00 00 00 00 00 00 00 00 00 00 00 01',
               'offset': '0'},
              {'ascii': '....BOBO ........ ....',
               'description': 'AppleWorks 6 document',
               'file_extension': 'cwk',
               'hex': '06 07 E1 00 42 4F 42 4F 06 07 E1 00 00 00 00 00 00 00 00 00 00 01',
               'offset': '0'},
              {'ascii': 'ER....ãER....',
               'description': 'RoxioToast disc image file, also some .dmg-files begin with '
               'same bytes',
                              'file_extension': 'toast',
               'hex': '45 52 02 00 00 00 8B 45 52 02 00 00 00',
               'offset': '0'},
              {'ascii': 'x.s.bb`',
               'description': 'Apple Disk Image file',
               'file_extension': 'dmg',
               'hex': '78 01 73 0D 62 62 60',
               'offset': '0'},
              {'ascii': 'xar!',
               'description': 'eXtensible Archive format',
               'file_extension': 'xar',
               'hex': '78 61 72 21',
               'offset': '0'},
              {'ascii': 'PMOCCMOC',
               'description': 'Windows Files And Settings Transfer Repository, See also USMT '
               '3.0 (Win XP) and USMT 4.0 (Win 7) User Guides',
                              'file_extension': 'dat',
               'hex': '50 4D 4F 43 43 4D 4F 43',
               'offset': '0'},
              {'ascii': 'NES',
               'description': 'Nintendo Entertainment System ROM file',
               'file_extension': 'nes',
               'hex': '4E 45 53 1A',
               'offset': '0'},
              {'ascii': 'ustar.00ustar  .',
               'description': 'tar archive',
               'file_extension': 'tar',
               'hex': '75 73 74 61 72 00 30 30 75 73 74 61 72 20 20 00',
               'offset': '0x101'},
              {'ascii': 'TOX',
               'description': 'Open source portable voxel file',
               'file_extension': 'tox',
               'hex': '74 6F 78 33',
               'offset': '0'},
              {'ascii': 'MLVI',
               'description': 'Magic Lantern Video file',
               'file_extension': 'MLV',
               'hex': '4D 4C 56 49',
               'offset': '0'},
              {'ascii': 'DCM PA30',
               'description': 'Windows UpdateBinary Delta Compression',
               'file_extension': '',
               'hex': '44 43 4D 01 50 41 33 30',
               'offset': '0'},
              {'ascii': "7z¼¯'",
               'description': '7-Zip File Format',
               'file_extension': '7z',
               'hex': '37 7A BC AF 27 1C',
               'offset': '0'},
              {'ascii': '..',
               'description': 'GZIP',
               'file_extension': 'gz',
               'hex': '1F 8B',
               'offset': '0'},
              {'ascii': '..',
               'description': 'GZIP',
               'file_extension': 'tar.gz',
               'hex': '1F 8B',
               'offset': '0'},
              {'ascii': '."M.',
               'description': 'LZ4 Frame Format, LZ4 block format does not offer any magic '
               'bytes.',
                              'file_extension': 'lz4',
               'hex': '04 22 4D 18',
               'offset': '0'},
              {'ascii': 'MSCF',
               'description': 'Microsoft Cabinet file',
               'file_extension': 'cab',
               'hex': '4D 53 43 46',
               'offset': '0'},
              {'ascii': 'FLIF',
               'description': 'Free Lossless Image Format',
               'file_extension': 'flif',
               'hex': '46 4C 49 46',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mkv',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mka',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mks',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mk3d',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'webm',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': 'MIL',
               'description': '"SEAN\xa0: Session Analysis" Training file. Also used in '
               'compatible software "Rpw\xa0:Rowperfect for Windows" and '
                              '"RP3W\xa0: ROWPERFECT3 for Windows".',
                              'file_extension': 'stg',
               'hex': '4D 49 4C 20',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': "['djvu', 'djv']",
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': 'djvu',
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': 'djv',
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': '0.',
               'description': 'DER encoded X.509 certificate',
               'file_extension': 'der',
               'hex': '30 82',
               'offset': '0'},
              {'ascii': 'DICM',
               'description': 'DICOM Medical File Format',
               'file_extension': 'dcm',
               'hex': '44 49 43 4D',
               'offset': '0x80'},
              {'ascii': 'wOFF',
               'description': 'WOFF File Format 1.0',
               'file_extension': 'woff',
               'hex': '77 4F 46 46',
               'offset': '0'},
              {'ascii': 'wOF2',
               'description': 'WOFF File Format 2.0',
               'file_extension': 'woff2',
               'hex': '77 4F 46 32',
               'offset': '0'},
              {'ascii': '<?xml',
               'description': 'eXtensible Markup Language when using theASCII character '
               'encoding',
                              'file_extension': 'XML',
               'hex': '3c 3f 78 6d 6c 20',
               'offset': '0'},
              {'ascii': '\\0asm',
               'description': 'WebAssembly binary format',
               'file_extension': 'wasm',
               'hex': '6d 73 61 00',
               'offset': '0'},
              {'ascii': '',
               'description': 'Lepton compressed JPEG image',
               'file_extension': 'lep',
               'hex': 'cf 84 01',
               'offset': '0'},
              {'ascii': 'CWS',
               'description': 'flash .swf',
               'file_extension': 'swf',
               'hex': '43 57 53',
               'offset': '0'},
              {'ascii': 'EWS',
               'description': 'flash .swf',
               'file_extension': 'swf',
               'hex': '46 57 53',
               'offset': '0'},
              {'ascii': '!<arch>.',
               'description': 'linux deb file',
               'file_extension': 'deb',
               'hex': '21 3C 61 72 63 68 3E',
               'offset': '0'},
              {'ascii': 'RIFF....',
               'description': 'Google WebP image file',
               'file_extension': 'webp',
               'hex': '52 49 46 46 nn nn nn nn',
               'offset': '0'},
              {'ascii': 'WEBP',
               'description': '',
               'file_extension': '',
               'hex': '57 45 42 50',
               'offset': ''},
              {'ascii': "'..V",
               'description': 'U-Boot / uImage.Das_U-Boot Universal Boot Loader.',
               'file_extension': '',
               'hex': '27 05 19 56',
               'offset': '0'}]

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
pyfsig-0.6.tar.gz (19.4 kB) Copy SHA256 hash SHA256 Source None Feb 26, 2017

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page