1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
|
#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
# reference: https://www.openoffice.org/sc/compdocfileformat.pdf
0 string \320\317\021\340\241\261\032\341
# https://digital-preservation.github.io/droid/
# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
>0x1A ushort !0xABAB OLE 2 Compound Document
#>0x1C uleshort x \b, endnian 0x%4.4x
# big endian not tested
>>0x1C ubeshort =0xfffe \b, big-endian
>>>546 string jbjb : Microsoft Word Document
!:mime application/msword
!:apple MSWDWDBN
!:ext doc
# Byte Order 0xFFFE means little-endian found in real world applications
#>>0x1C uleshort =0xfffe \b, little-endian
>>0x1C uleshort =0xfffe
# From: Joerg Jenderek
# Major Version 3 or 4
>>>0x1A uleshort x \b, v%u
# Minor Version 32h=50 3Bh=59 3Eh=62
>>>0x18 uleshort x \b.%u
# SecID of first sector of the directory stream is often 1 but high like 3144h
>>>48 ulelong x \b, SecID 0x%x
# pointer to root entry only works with standard configuration for SecID ~< 800h
# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
# "ORLEN Factbook 2017.xls" XnView_metadata.doc
# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
>>>0x1E uleshort 0xc \b, blocksize 4096
# jump to one block (4096 bytes per block) before root storage block
>>>>(48.l*4096) ubyte x
>>>>>&4095 use ole2-directory
#>>>0x1E uleshort 9 \b, blocksize 512
>>>0x1E uleshort 9
# jump to one block (512 bytes per block) before root storage block
# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
>>>>(48.l*512) ubyte x
>>>>>&511 use ole2-directory
# check directory entry structure and display types by GUID
0 name ole2-directory
# directory entry name like "Root Entry"
#>0 lestring16 x \b, 1st %.10s
# type of the entry; 5~Root storage
#>66 ubyte x \b, type %x
# node colour of the entry: 00H ~ Red 01H ~ Black
#>67 ubyte x \b, color %x
# the DirIDs of the child nodes. Should both be –1 in the root storage entry
#>68 bequad !0xffffffffffffffff \b, DirIDs %llx
# second directory entry name like VisioDocument Control000
#>128 lestring16 x \b, 2nd %.20s
# third directory entry like WordDocument
#>256 lestring16 x \b, 3rd %.20s
# forth
#>384 lestring16 x \b, 4th %.10s
# 5th
#>512 lestring16 x \b, 5th %.10s
# 6th
#>640 lestring16 x \b, 6th %.10s
# 7th
#>768 lestring16 x \b, 7th %.10s
# https://wikileaks.org/ciav7p1/cms/page_13762814.html
# https://m.blog.naver.com/superman4u/40047693679
# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
# http://www.windowstricks.in/online-windows-guid-converter
#>80 ubequad !0 \b, clsid 0x%16.16llx
#>>88 ubequad x \b%16.16llx
# test for "Root Entry" inside directory by type 5 value
>66 ubyte 5
# look for CLSID GUID 0
>>88 ubequad 0x0
>>>80 ubequad 0x0
# - Microstation V8 DGN files (www.bentley.com)
# URL: https://en.wikipedia.org/wiki/MicroStation
# Last update on 10/23/2006 by Lester Hightower
# 07/24/2019 by Joerg Jenderek
# Second directory entry name like Dgn~H Dgn~S
>>>>128 lestring16 Dgn~ : Microstation V8 CAD
#!:mime application/x-ole-storage
!:mime application/x-bentley-dgn
# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
!:ext dgn
#
# URL: http://fileformats.archiveteam.org/wiki/WordPerfect
# Second directory entry name PerfectOffice_
>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic
!:mime application/vnd.wordperfect
# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
!:apple ????WPC7
!:ext mst/wpd/wpg
#
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
# Second directory entry name MatOST_
>>>>128 lestring16 MatOST : Microsoft Works 3.0 document
!:mime application/vnd.ms-works
!:apple ????AWWP
!:ext wps
#
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
# 3rd directory entry name WksSSWorkBook
>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet
!:mime application/vnd.ms-works
!:apple ????AWSS
!:ext xlr
#
# URL: http://fileformats.archiveteam.org/wiki/XLS
# what is the difference to {00020820-0000-0000-c000-000000000046} ?
# Second directory entry name Workbook
>>>>128 lestring16 Workbook
>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid
!:mime application/vnd.ms-excel
# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
!:apple ????XLS9
!:ext xls
#
# URL: http://fileformats.archiveteam.org/wiki/PPT
# Second directory entry name Object1 Object12 Object35
>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation
!:mime application/vnd.ms-powerpoint
# https://www.macdisk.com/macsigen.php
!:apple ????PPT3
!:ext ppt
#
# URL: https://www.msoutlook.info/question/164
# Second directory entry name __CollDataStm
>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings
#!:mime application/vnd.ms-outlook
!:mime application/x-ms-srs
# %APPDATA%\Microsoft\Outlook\Outlook.srs
!:ext srs
#
# URL: https://www.file-extensions.org/cag-file-extension
# Second directory entry name Category
>>>>128 lestring16 Category : Microsoft Clip Art Gallery
#!:mime application/x-ole-storage
!:mime application/x-ms-cag
!:apple MScgCGdb
!:ext cag/
#
# URL: https://www.filesuffix.com/de/extension/rra
# 3rd directory entry name StrIndex_StringTable
>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer
#!:mime application/x-ole-storage
!:mime application/x-ms-rra
!:ext rra
#
# URL: https://www.forensicswiki.org/wiki/Jump_Lists
# 3rd directory entry name DestList
>>>>256 lestring16 DestList : Windows jump list
#!:mime application/x-ole-storage
!:mime application/x-ms-jumplist
# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
!:ext automaticDestinations-ms
#
# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache
# Second directory entry name 256_
>>>>128 lestring16 256_ : Windows thumbnail database 256
#!:mime application/x-ole-storage
!:mime application/x-ms-thumbnail
# Thumbs.db
!:ext db
>>>>128 lestring16 96_ : Windows thumbnail database 96
!:mime application/x-ms-thumbnail
!:ext db
# 3rd directory entry name Catalog_
>>>>256 lestring16 Catalog : Windows thumbnail database
!:mime application/x-ms-thumbnail
!:ext db
#
# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
# Second directory entry name Control000
>>>>128 lestring16 Control000 : Microsoft old Systeminfo
#!:mime application/x-ole-storage
!:mime application/x-ms-info
!:ext nfo
#
# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
# Second directory entry name Thumbnail
>>>>128 lestring16 Thumbnail : Corel PrintHouse image
#!:mime application/x-ole-storage
!:mime application/x-corel-cph
!:ext cph
# 3rd directory entry name Thumbnail
>>>>256 lestring16 Thumbnail : Corel PrintHouse image
!:mime application/x-corel-cph
!:ext cph
#
# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
# Note: "HWP Document File" signature found in FileHeader
# Second directory entry name FileHeader hint for Thinkfree Office document
>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File
#!:mime application/haansofthwp
!:mime application/x-hwp
# https://example-files.online-convert.com/document/hwp/example.hwp
!:ext hwp
#
# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
>>>>128 lestring16 dd2 : StarOffice Gallery view
#!:mime application/x-ole-storage
!:mime application/x-star-sdv
!:ext sdv
# remaining null clsid
>>>>128 default x : UNKNOWN
!:mime application/x-ole-storage
# look for known clsid GUID
# - Visio documents
# URL: http://fileformats.archiveteam.org/wiki/Visio
# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
>>88 ubequad 0xc000000000000046 : Microsoft
>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template
!:mime application/vnd.visio
# VSD~Drawing VSS~Stencil VST~Template
!:ext vsd/vss/vst
>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template
!:mime application/vnd.visio
!:ext vsd/vss/vst
#
# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
>>>80 ubequad 0x84100c0000000000 Windows Installer Package
!:mime application/x-msi
#!:mime application/x-ms-win-installer
!:ext msi
>>>80 ubequad 0x86100c0000000000 Windows Installer Patch
# ??
!:mime application/x-wine-extension-msp
#!:mime application/x-ms-msp
!:ext msp
#
# URL: http://fileformats.archiveteam.org/wiki/DOC
>>>80 ubequad 0x0009020000000000 Word 6-95 document or template
!:mime application/msword
# for template MSWDW8TN
!:apple MSWDWDBN
!:ext doc/dot
>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template
!:mime application/msword
!:apple MSWDWDBN
# dot for template; no extension on Macintosh
!:ext doc/dot/
#
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
>>>80 ubequad 0x0213020000000000 Works 3-4 document or template
!:mime application/vnd.ms-works
!:apple ????AWWP
# ps for template https://filext.com/file-extension/PS bps for backup
!:ext wps/ps/bps
#
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
>>>80 ubequad 0x0313020000000000 Works 3-4 database or template
!:mime application/vnd.ms-works-db
# https://www.macdisk.com/macsigen.php
!:apple ????AWDB
# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
!:ext wdb/db/bdb
#
# URL: https://en.wikipedia.org/wiki/Microsoft_Excel
>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template
!:mime application/vnd.ms-excel
# https://www.macdisk.com/macsigen.php
!:apple ????XLS5
# worksheet/addin/template/no extension on Macintosh
!:ext xls/xla/xlt/
#
>>>80 ubequad 0x2008020000000000 Excel 97-2003
!:mime application/vnd.ms-excel
# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
!:apple ????XLS9
# 3nd directory entry name
>>>>256 lestring16 _VBA_PROJECT_CUR addin
!:ext xla/
# 4th directory entry name
>>>>384 lestring16 _VBA_PROJECT_CUR addin
!:ext xla
#!:ext xla/
>>>>256 default x worksheet or template
!:ext xls/xlt
#!:ext xls/xlt/
#
# URL: http://fileformats.archiveteam.org/wiki/OLE2
>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message
#!:mime application/vnd.ms-outlook
!:mime application/x-ms-msg
!:ext msg
# URL: https://wiki.fileformat.com/email/oft/
>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
#!:mime application/vnd.ms-outlook
!:mime application/x-ms-oft
!:ext oft
#
# URL: http://fileformats.archiveteam.org/wiki/PPT
>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation
!:mime application/vnd.ms-powerpoint
# https://www.macdisk.com/macsigen.php
!:apple ????PPT3
!:ext ppt
#??
# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
>>88 ubequad 0xa29a00aa004a1a72 : Microsoft
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document
!:mime application/vnd.ms-works
!:apple ????AWWP
!:ext wps
#
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database
!:mime application/vnd.ms-works-db
!:apple ????AWDB
!:ext wdb/bdb
#??
>>88 ubequad 0xa40700c04fb932ba : Microsoft
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document
!:mime application/vnd.ms-works
!:apple ????AWWP
!:ext wps
#??
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
>>88 ubequad 0x00c0000000000046 : Microsoft
>>>80 ubequad 0x0112020000000000 Publisher
!:mime application/vnd.ms-publisher
!:ext pub
#
# URL: http://fileformats.archiveteam.org/wiki/PPT
#??
>>88 ubequad 0xa90300aa00510ea3 : Microsoft
>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation
!:mime application/vnd.ms-powerpoint
# https://www.macdisk.com/macsigen.php
!:apple ????PPT3
!:ext ppt/pot
#??
>>88 ubequad 0x86ea00aa00b929e8 : Microsoft
>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template
!:mime application/vnd.ms-powerpoint
!:apple ????PPT3
# /autostart/template
!:ext ppt/pps/pot
#
# URL: https://en.wikipedia.org/wiki/Microsoft_Project
#??
>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft
>>>80 ubequad 0x3a8fb774c8c8d111 Project
!:mime application/vnd.ms-project
!:ext mpp
#
# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
#???
>>88 ubequad 0x99ae04021c007002 : WordPerfect
>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation
!:mime application/x-corelpresentations
#!:mime application/x-shw-viewer
#!:mime image/x-presentations
!:ext shw
#
# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
>>>80 ubequad 0x60fe2e4099191b10 9 Graphic
#!:mime application/x-wpg
#!:mime image/x-wordperfect-graphics
!:mime image/x-wpg
# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
!:apple ????WPC9
!:ext wpg
#
# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
>>88 ubequad 0x996104021c007002 : StarOffice
>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template
# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
!:mime application/x-starwriter
!:ext sdw/vor
#
>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template
!:mime application/x-starcalc
!:ext sdc/vor
#
>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template
!:mime application/x-starimpress
#!:mime application/x-stardraw
# sda ??
!:ext sdd/sda/vor
#??
>>88 ubequad 0x89cb008029e4b0b1 : StarOffice
>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template
!:mime application/x-starcalc
!:ext sdc/vor
#
>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template
!:mime application/vnd.stardivision.cal
!:ext sdc/vor
#
>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template
!:mime application/x-starimpress
!:ext sdd/vor
#??
>>88 ubequad 0xb12a04021c007002 : StarOffice
>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0
!:mime application/x-starmath
!:ext smf
#??
>>88 ubequad 0x8e2c00001b4cc711 : StarOffice
>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0
!:mime application/x-starchart
!:ext sds
#??
>>88 ubequad 0xa45e00a0249d57b1 : StarOffice
>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template
!:mime application/x-starwriter
!:ext sdw/vor
#??
>>88 ubequad 0x89ca008029e4b0b1 : StarOffice
>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0
!:mime application/x-starmath
!:ext smf
#
>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0
!:mime application/x-starchart
!:ext sds
#??
>>88 ubequad 0xa53f00a0249d57b1 : StarOffice
>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document
!:mime application/x-starwriter-global
!:ext sgl
#??
>>88 ubequad 0x89d0008029e4b0b1 : StarOffice
>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0
!:mime application/vnd.stardivision.math
!:ext smf
#
>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template
!:mime application/vnd.stardivision.draw
!:ext sda/vor
#
>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template
!:mime application/vnd.stardivision.impress
# sda is used for what?
!:ext sdd/vor/sda
#
>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0
!:mime application/vnd.stardivision.chart
!:ext sds
# ??
>>88 ubequad 0xaab4006097da561a : StarOffice
>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template
!:mime application/vnd.stardivision.writer
!:ext sdw/vor
#
>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document
!:mime application/vnd.stardivision.writer-global
!:ext sgl
#??
# URL: http://fileformats.archiveteam.org/wiki/FlashPix
>>88 ubequad 0x855300aa00a1f95b : Kodak
>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image
!:mime image/vnd.fpx
!:apple ????FPix
!:ext fpx
# remaining non null clsid
>>88 default x : UNKNOWN
!:mime application/x-ole-storage
>>>80 ubequad !0 \b, clsid 0x%16.16llx
>>>88 ubequad x \b%16.16llx
|