Monday, December 24, 2012

  • Cheat Codes While playing the game or at the pause menu, enter one of the following codes to activate the corresponding cheat function. If you entered the code correctly, a message "Cheat Activated" will appear.
    Result Cheat Code
    Health [Note 1]aspirine
    Armorpreciousprotection
    Weapons (tier 1)thugstools
    Weapons (tier 2)professionaltools
    Weapons (tier 3)nuttertools
    Raise wanted levelyouwonttakemealive
    Lower wanted levelleavemealone
    View media level when over two starschasestat
    Better driving skillsgripiseverything
    Dodo cars (flying) [Note 2]comeflywithme
    Rhino tankpanzer
    Faster game clocklifeispassingmeby
    Faster game playonspeed
    Slower game playbooooooring
    Destroy all carsbigbang
    Pedestrians riotfightfightfight
    Pedestrians attack younobodylikesme
    Pedestrians have weaponsourgodgivenrighttobeararms
    Pedestrians enter your carhopingirl
    Change wheel sizeloadsoflittlethings
    Only wheels visible on carswheelsareallineed
    Bikini women with guns [Note 3]chickswithguns
    Heavy trafficmiamitraffic
    Pink trafficahairdresserscar
    Black trafficiwantitpaintedblack
    All traffic lights greengreenlight
    Romero's Hearsethelastride
    Love Fist Limousinerockandrollcar
    Trashmasterrubbishcar
    Bloodring Banger (style 1)travelinstyle
    Bloodring Banger (style 2)gettherequickly
    Caddybetterthanwalking
    Pedestrian costumes [Note 4]stilllikedressingup
    Lance Vance costumelooklikelance
    Ken Rosenberg costumemysonisalawyer
    Hilary King costumeilooklikehilary
    Jezz Torent (Love Fist) costumerockandrollman
    Dick (Love Fist) costumeweloveourdick
    Phil Cassaday costumeonearmedbandit
    Sonny Forelli costumeidonthavethemoneysonny
    Mercedes costumefoxylittlething
    Cars float on waterseaways
    Engines are fastergetthereveryfastindeed
    Engines very fastgetthereamazinglyfast
    All cars are fastergettherefast
    Tommy groupies [Note 5]fannymagnet
    Ricardo Diaz costumecheatshavebeencracked
    Tommy smokes cigarettecertaindeath
    Tommy is fatterdeepfriedmarsbars
    Tommy has thin arms and legsprogrammer
    Good weatherapleasantday
    Great weatheralovelyday
    Sunny weatherabitdrieg
    Stormy weathercatsanddogs
    Foggy weathercantseeathing
    Reguard targetairship
    Commit suicideicanttakeitanymore
    Note 1: If this code is enabled when there is damage on your car, the meter will be reset to zero without changing the visible effects of the damage.
    Note 2: You will not be able to fly a helicopter correctly when this code is activated.
    Note 3: The women will drop guns when they are killed.
    Note 4: Repeat this code to cycle through the various pedestrian costumes, including a cop.
    Note 5: Aim your gun at someone and they will attack your target.
    -From: 777@personal.ro and ipe10100@hotmail.com
  • Thursday, December 13, 2012

    Keyboard Shorcuts (Microsoft Windows)
    1. CTRL+C (Copy)

    2. CTRL+X (Cut)
    ...... 3. CTRL+V (Paste)
    4. CTRL+Z (Undo)
    5. DELETE (Delete)
    6. SHIFT+DELETE (Delete the selected item permanently without placing the item in the Recycle Bin)
    7. CTRL while dragging an item (Copy the selected item)
    8. CTRL+SHIFT while dragging an item (Create a shortcut to the selected item)
    9. F2 key (Rename the selected item)
    10. CTRL+RIGHT ARROW (Move the insertion point to the beginning of the next word)
    11. CTRL+LEFT ARROW (Move the insertion point to the beginning of the previous word)
    12. CTRL+DOWN ARROW (Move the insertion point to the beginning of the next paragraph)
    13. CTRL+UP ARROW (Move the insertion point to the beginning of the previous paragraph)
    14. CTRL+SHIFT with any of the arrow keys (Highlight a block of text)
    SHIFT with any of the arrow keys (Select more than one item in a window or on the desktop, or select text in a document)
    15. CTRL+A (Select all)
    16. F3 key (Search for a file or a folder)
    17. ALT+ENTER (View the properties for the selected item)
    18. ALT+F4 (Close the active item, or quit the active program)
    19. ALT+ENTER (Display the properties of the selected object)
    20. ALT+SPACEBAR (Open the shortcut menu for the active window)
    21. CTRL+F4 (Close the active document in programs that enable you to have multiple documents opensimultaneou sly)
    22. ALT+TAB (Switch between the open items)
    23. ALT+ESC (Cycle through items in the order that they had been opened)
    24. F6 key (Cycle through the screen elements in a window or on the desktop)
    25. F4 key (Display the Address bar list in My Computer or Windows Explorer)
    26. SHIFT+F10 (Display the shortcut menu for the selected item)
    27. ALT+SPACEBAR (Display the System menu for the active window)
    28. CTRL+ESC (Display the Start menu)
    29. ALT+Underlined letter in a menu name (Display the corresponding menu) Underlined letter in a command name on an open menu (Perform the corresponding command)
    30. F10 key (Activate the menu bar in the active program)
    31. RIGHT ARROW (Open the next menu to the right, or open a submenu)
    32. LEFT ARROW (Open the next menu to the left, or close a submenu)
    33. F5 key (Update the active window)
    34. BACKSPACE (View the folder onelevel up in My Computer or Windows Explorer)
    35. ESC (Cancel the current task)
    36. SHIFT when you insert a CD-ROMinto the CD-ROM drive (Prevent the CD-ROM from automatically playing)
    Dialog Box - Keyboard Shortcuts
    1. CTRL+TAB (Move forward through the tabs)
    2. CTRL+SHIFT+TAB (Move backward through the tabs)
    3. TAB (Move forward through the options)
    4. SHIFT+TAB (Move backward through the options)
    5. ALT+Underlined letter (Perform the corresponding command or select the corresponding option)
    6. ENTER (Perform the command for the active option or button)
    7. SPACEBAR (Select or clear the check box if the active option is a check box)
    8. Arrow keys (Select a button if the active option is a group of option buttons)
    9. F1 key (Display Help)
    10. F4 key (Display the items in the active list)
    11. BACKSPACE (Open a folder one level up if a folder is selected in the Save As or Open dialog box)

    Microsoft Natural Keyboard Shortcuts
    1. Windows Logo (Display or hide the Start menu)
    2. Windows Logo+BREAK (Display the System Properties dialog box)
    3. Windows Logo+D (Display the desktop)
    4. Windows Logo+M (Minimize all of the windows)
    5. Windows Logo+SHIFT+M (Restorethe minimized windows)
    6. Windows Logo+E (Open My Computer)
    7. Windows Logo+F (Search for a file or a folder)
    8. CTRL+Windows Logo+F (Search for computers)
    9. Windows Logo+F1 (Display Windows Help)
    10. Windows Logo+ L (Lock the keyboard)
    11. Windows Logo+R (Open the Run dialog box)
    12. Windows Logo+U (Open Utility Manager)
    13. Accessibility Keyboard Shortcuts
    14. Right SHIFT for eight seconds (Switch FilterKeys either on or off)
    15. Left ALT+left SHIFT+PRINT SCREEN (Switch High Contrast either on or off)
    16. Left ALT+left SHIFT+NUM LOCK (Switch the MouseKeys either on or off)
    17. SHIFT five times (Switch the StickyKeys either on or off)
    18. NUM LOCK for five seconds (Switch the ToggleKeys either on or off)
    19. Windows Logo +U (Open Utility Manager)
    20. Windows Explorer Keyboard Shortcuts
    21. END (Display the bottom of the active window)
    22. HOME (Display the top of the active window)
    23. NUM LOCK+Asterisk sign (*) (Display all of the subfolders that are under the selected folder)
    24. NUM LOCK+Plus sign (+) (Display the contents of the selected folder)
    25. NUM LOCK+Minus sign (-) (Collapse the selected folder)
    26. LEFT ARROW (Collapse the current selection if it is expanded, or select the parent folder)
    27. RIGHT ARROW (Display the current selection if it is collapsed, or select the first subfolder)
    Shortcut Keys for Character Map
    After you double-click a character on the grid of characters, you can move through the grid by using the keyboard shortcuts:
    1. RIGHT ARROW (Move to the rightor to the beginning of the next line)
    2. LEFT ARROW (Move to the left orto the end of the previous line)
    3. UP ARROW (Move up one row)
    4. DOWN ARROW (Move down one row)
    5. PAGE UP (Move up one screen at a time)
    6. PAGE DOWN (Move down one screen at a time)
    7. HOME (Move to the beginning of the line)
    8. END (Move to the end of the line)
    9. CTRL+HOME (Move to the first character)
    10. CTRL+END (Move to the last character)
    11. SPACEBAR (Switch between Enlarged and Normal mode when a character is selected)
    Microsoft Management Console (MMC)
    Main Window Keyboard Shortcuts
    1. CTRL+O (Open a saved console)
    2. CTRL+N (Open a new console)
    3. CTRL+S (Save the open console)
    4. CTRL+M (Add or remove a console item)
    5. CTRL+W (Open a new window)
    6. F5 key (Update the content of all console windows)
    7. ALT+SPACEBAR (Display the MMC window menu)
    8. ALT+F4 (Close the console)
    9. ALT+A (Display the Action menu)
    10. ALT+V (Display the View menu)
    11. ALT+F (Display the File menu)
    12. ALT+O (Display the Favorites menu)

    MMC Console Window Keyboard Shortcuts
    1. CTRL+P (Print the current page or active pane)
    2. ALT+Minus sign (-) (Display the window menu for the active console window)
    3. SHIFT+F10 (Display the Action shortcut menu for the selected item)
    4. F1 key (Open the Help topic, if any, for the selected item)
    5. F5 key (Update the content of all console windows)
    6. CTRL+F10 (Maximize the active console window)
    7. CTRL+F5 (Restore the active console window)
    8. ALT+ENTER (Display the Properties dialog box, if any, for theselected item)
    9. F2 key (Rename the selected item)
    10. CTRL+F4 (Close the active console window. When a console has only one console window, this shortcut closes the console)
    Remote Desktop Connection Navigation
    1. CTRL+ALT+END (Open the Microsoft Windows NT Security dialog box)
    2. ALT+PAGE UP (Switch between programs from left to right)
    3. ALT+PAGE DOWN (Switch between programs from right to left)
    4. ALT+INSERT (Cycle through the programs in most recently used order)
    5. ALT+HOME (Display the Start menu)
    6. CTRL+ALT+BREAK (Switch the client computer between a window and a full screen)
    7. ALT+DELETE (Display the Windows menu)
    8. CTRL+ALT+Minus sign (-) (Place a snapshot of the active window in the client on the Terminal server clipboard and provide the same functionality as pressing PRINT SCREEN on a local computer.)
    9. CTRL+ALT+Plus sign (+) (Place asnapshot of the entire client window area on the Terminal server clipboardand provide the same functionality aspressing ALT+PRINT SCREEN on a local computer.)

    Microsoft Internet Explorer Keyboard Shortcuts
    1. CTRL+B (Open the Organize Favorites dialog box)
    2. CTRL+E (Open the Search bar)
    3. CTRL+F (Start the Find utility)
    4. CTRL+H (Open the History bar)
    5. CTRL+I (Open the Favorites bar)
    6. CTRL+L (Open the Open dialog box)
    7. CTRL+N (Start another instance of the browser with the same Web address)
    8. CTRL+O (Open the Open dialog box,the same as CTRL+L)
    9. CTRL+P (Open the Print dialog box)
    10. CTRL+R (Update the current Web )

    FILE SIGNATURES TABLE

    21 October 2012


    This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I have found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list. See also Wikipedia's List of file signatures. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net.
    This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:
    Some useful additional information:


    Hex Signature   ASCII Signature
    File Extension File Description
    TGA Truevision Targa Graphic file
    Trailer:
    54 52 55 45 56 49 53 49   TRUEVISI
    4F 4E 2D 58 46 49 4C 45   ON-XFILE
    2E 00                     ..
    00 .
    PIC IBM Storyboard bitmap file
    MOV Apple QuickTime movie file
    PIF Windows Program Information File
    SEA Mac Stuffit Self-Extracting Archive
    YTR IRIS OCR data file
    [11 byte offset]
    00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00
     [11 byte offset]
    ........
    ........
    ........
    PDB Palmpilot Database/Document File
    [512 byte offset]
    00 00 00 00 00 00 00 00
     [512 byte offset]
    ........
    RVT Revit Project File subheader
    00 00 00 0C 6A 50 20 20
    0D 0A
     ....jP
    ..
    JP2 Various JPEG-2000 image file formats
    00 00 00 nn 66 74 79 70
    33 67 70
     ....ftyp
    3gp
    3GG, 3GP, 3G2 3rd Generation Partnership Project 3GPP (nn=0x14)
    and 3GPP2 (nn=0x20) multimedia files
    00 00 00 14 66 74 79 70
    69 73 6F 6D
     ....ftyp
    isom
    MP4 ISO Base Media file (MPEG-4) v1
    00 00 00 14 66 74 79 70
    71 74 20 20
     ....ftyp
    qt
    MOV QuickTime movie file
    00 00 00 18 66 74 79 70
    33 67 70 35
     ....ftyp
    3gp5
    MP4 MPEG-4 video files
    00 00 00 18 66 74 79 70
    6D 70 34 32
     ....ftyp
    mp42
    M4V MPEG-4 video/QuickTime file
    00 00 00 1C 66 74 79 70
    4D 53 4E 56 01 29 00 46
    4D 53 4E 56 6D 70 34 32
     ....ftyp
    MSNV.).F
    MSNVmp42
    MP4 MPEG-4 video file
    00 00 00 20 66 74 79 70
    4D 34 41 20
     ... ftyp
    M4A
    M4A Apple Lossless Audio Codec file
    00 00 01 00 ....
    ICO Windows icon file
    SPL Windows NT/2000/XP printer spool file
    00 00 01 Bx ....
    MPEG, MPG MPEG video file
    Trailer:
    00 00 01 B7 (...·)
    00 00 01 BA ....º
    MPG, VOB DVD Video Movie File (video/dvd, video/mpeg) or DVD MPEG2
    Trailer:
    00 00 01 B9 (...¹)
    00 00 02 00 ......
    CUR Windows cursor file
    WB2 QuattroPro for Windows Spreadsheet file
    00 00 02 00 06 04 06 00
    08 00 00 00 00 00
     ........
    ......
    WK1 Lotus 1-2-3 spreadsheet (v1) file
    00 00 1A 00 00 10 04 00
    00 00 00 00
     ........
    ....
    WK3 Lotus 1-2-3 spreadsheet (v3) file
    00 00 1A 00 02 10 04 00
    00 00 00 00
     ........
    ....
    WK4, WK5 Lotus 1-2-3 spreadsheet (v4, v5) file
    00 00 1A 00 05 10 04 .......
    123 Lotus 1-2-3 spreadsheet (v9) file
    00 00 49 49 58 50 52 or ..IIXPR
    00 00 4D 4D 58 50 52 ..MMXPR
    QXD Quark Express document (Intel & Motorola, respectively)
    NOTE: It appears that the byte following the 0x52 ("R") is
    the language indicator; 0x33 ("3") seems to indicate English
    and 0x61 ("a") reportedly indicates Korean.
    00 00 FE FF ..þÿ
    n/a Byte-order mark for 32-bit Unicode Transformation Format/
    4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
    (See the Unicode Home Page.)
    [6 byte offset]
    00 00 FF FF FF FF
     [6 byte offset]
    ..ÿÿÿÿ
    HLP Windows Help file
    00 01 00 00 4D 53 49 53
    41 4D 20 44 61 74 61 62
    61 73 65
     ....MSIS
    AM Datab
    ase
    MNY Microsoft Money file
    00 01 00 00 53 74 61 6E
    64 61 72 64 20 41 43 45
    20 44 42
     ....Stan
    dard ACE
     DB
    ACCDB Microsoft Access 2007 file
    00 01 00 00 53 74 61 6E
    64 61 72 64 20 4A 65 74
    20 44 42
     ....Stan
    dard Jet
     DB
    MDB Microsoft Access file
    00 01 00 08 00 01 00 01
    01
     ........
    .
    IMG Ventura Publisher/GEM VDI Image Format Bitmap file
    00 01 01 ...
    FLT OpenFlight 3D file
    00 01 42 41 ..BA
    ABA Palm Address Book Archive file
    00 01 42 44 ..BD
    DBA Palm DateBook Archive file
    00 06 15 61 00 00 00 02
    00 00 04 D2 00 00 10 00
     ...a....
    ...Ò....
    DB Netscape Navigator (v4) database file
    00 11 AF ..¯
    FLI FLIC Animation file
    00 14 00 00 01 02 xx xx
    03
     ........
    .
    n/a BIOS details in RAM images
    00 1E 84 90 00 00 00 00 ..„.....
    SNM Netscape Communicator (v4) mail folder
    00 5C 41 B1 FF .\A±ÿ
    ENC Mujahideen Secrets 2 encrypted file
    00 BF .¿
    SOL Adobe Flash shared object file (e.g., Flash cookies)
    [512 byte offset]
    00 6E 1E F0
     [512 byte offset]
    .n.ð
    PPT PowerPoint presentation subheader (MS Office)
    00 FF FF FF FF FF FF FF
    FF FF FF 00 00 02 00 01
     .ÿÿÿÿÿÿÿ
    ÿÿÿ.....
    MDF Alcohol 120% CD image
    01 00 00 00 ....
    EMF Extended (Enhanced) Windows Metafile Format, printer spool file
    (0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)
    01 00 00 00 01 .....
    PIC Unknown type picture file
    01 00 09 00 00 03 ......
    WMF Windows Metadata file (Win 3.x format)
    01 00 39 30 ..90
    FDB, GDB Firebird and Interbase database files, respectively. See
    IBPhoenix for more information.
    01 0F 00 00 ....
    MDF Microsoft SQL Server 2000 database
    01 10 ..
    TR1 Novell LANalyzer capture file
    01 DA 01 01 00 03 .Ú....
    RGB Silicon Graphics RGB Bitmap
    01 FF 02 04 03 02 .ÿ....
    DRW Micrografx vector graphic file
    02 64 73 73 .dss
    DSS Digital Speech Standard (Olympus, Grundig, & Phillips)
    03 .
    DAT MapInfo Native Data Format
    DB3 dBASE III file
    03 00 00 00 ....
    QPH Quicken price history file
    03 00 00 00 41 50 50 52 ....APPR
    ADX Approach index file
    04 .
    DB4 dBASE IV data file
    04 00 00 00 xx xx xx xx
    xx xx xx xx 20 03 00 00
     or
     ........
    .... ...
    05 00 00 00 xx xx xx xx
    xx xx xx xx 20 03 00 00
     ........
    .... ...
    n/a INFO2 Windows recycle bin file. NOTE: Bytes 12-13
    indicate the size of each INFO2 record; the most common
    value is 0x02-03 (0x0320 = 800 bytes).
    07 .
    DRW A common signature and file extension for many drawing
    programs.
    07 53 4B 46 .SKF
    SKF SkinCrafter skin file
    07 64 74 32 64 64 74 64 .dt2ddtd
    DTD DesignTools 2D Design file
    08 .
    DB dBASE IV or dBFast configuration file
    [512 byte offset]
    09 08 10 00 00 06 05 00
     [512 byte offset]
    ........
    XLS Excel spreadsheet subheader (MS Office)
    0A nn 01 01 ....
    PCX ZSOFT Paintbrush file
    (where nn = 0x02, 0x03, or 0x05)
    0C ED 
    MP Monochrome Picture TIFF bitmap file (unconfirmed)
    0D 44 4F 43 .DOC
    DOC DeskMate Document file
    0E 4E 65 72 6F 49 53 4F .NeroISO
    NRI Nero CD Compilation
    0E 57 4B 53 .WKS
    WKS DeskMate Worksheet
    [512 byte offset]
    0F 00 E8 03
     [512 byte offset]
    ..è.
    PPT PowerPoint presentation subheader (MS Office)
    11 00 00 00 53 43 43 41 ....SCCA
    PF Windows prefetch file
    1A 00 00 ...
    NTF Lotus Notes database template
    1A 00 00 04 00 00 ......
    NSF Lotus Notes database
    1A 0x ..
    ARC LH archive file, old version
    (where x = 0x2, 0x3, 0x4, 0x8 or 0x9
    for types 1-5, respectively)
    1A 0B ..
    PAK Compressed archive file
    (often associated with Quake Engine games)
    1A 35 01 00 .5..
    ETH GN Nettest WinPharoah capture file
    1A 45 DF A3 93 42 82 88
    6D 61 74 72 6F 73 6B 61
     .Eߣ“B‚ˆ
    matroska
    MKV Matroska stream file
    1A 52 54 53 20 43 4F 4D
    50 52 45 53 53 45 44 20
    49 4D 41 47 45 20 56 31
    2E 30 1A
     .RTS COM
    PRESSED
    IMAGE V1
    .0.
    DAT Runtime Software disk image
    1D 7D .}
    WS WordStar Version 5.0/6.0 document
    1F 8B 08 .‹.
    GZ, TGZ GZIP archive file
    1F 9D ..
    TAR.Z Compressed tape archive file using standard (Lempel-Ziv-Welch) compression
    1F A0 
    TAR.Z Compressed tape archive file using LZH (Lempel-Ziv-Huffman) compression
    21 !
    BSB MapInfo Sea Chart
    21 12 !.
    AIN AIN Compressed Archive
    21 3C 61 72 63 68 3E 0A !<arch>.
    LIB Unix archiver (ar) files and Microsoft Program Library
    Common Object File Format (COFF)
    21 42 44 4E !BDN
    PST Microsoft Outlook Personal Folder File
    23 20 #
    MSI Cerius2 file
    23 20 44 69 73 6B 20 44
    65 73 63 72 69 70 74 6F
     # Disk D
    escripto
    VMDK VMware 4 Virtual Disk description file (split disk)
    23 20 4D 69 63 72 6F 73
    6F 66 74 20 44 65 76 65
    6C 6F 70 65 72 20 53 74
    75 64 69 6F
     # Micros
    oft Deve
    loper St
    udio
    DSP Microsoft Developer Studio project file
    23 21 41 4D 52 #!AMR
    AMR Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
    Codec, commonly audio format with GSM cell phones. (See RFC 4867.)
    23 3F 52 41 44 49 41 4E
    43 45 0A
     #?RADIAN
    CE.
    HDR Radiance High Dynamic Range image file
    24 46 4C 32 40 28 23 29
    20 53 50 53 53 20 44 41
    54 41 20 46 49 4C 45
     $FL2@(#)
     SPSS DA
    TA FILE
    SAV SPSS Data file
    25 21 50 53 2D 41 64 6F
    62 65 2D 33 2E 30 20 45
    50 53 46 2D 33 20 30
     %!PS-Ado
    be-3.0 E
    PSF-3.0
    EPS Adobe encapsulated PostScript file
    (If this signature is not at the immediate
    beginning of the file, it will occur early
    in the file, commonly at byte offset 30)
    25 50 44 46 %PDF
    PDF, FDF Adobe Portable Document Format and Forms Document file
    Trailers:
    0A 25 25 45 4F 46 (.%%EOF)
    0A 25 25 45 4F 46 0A (.%%EOF.)
    0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
    0D 25 25 45 4F 46 0D (.%%EOF.)
    NOTE: There may be multiple end-of-file marks within the
    file. When carving, be sure to get the last one.
    28 54 68 69 73 20 66 69
    6C 65 20 6D 75 73 74 20
    62 65 20 63 6F 6E 76 65
    72 74 65 64 20 77 69 74
    68 20 42 69 6E 48 65 78
    20
     (This fi
    le must
    be conve
    rted wit
    h BinHex
     
    HQX Macintosh BinHex 4 Compressed Archive
    2A 2A 2A 20 20 49 6E 73
    74 61 6C 6C 61 74 69 6F
    6E 20 53 74 61 72 74 65
    64 20
     ***  Ins
    tallatio
    n Starte
    d
    LOG Symantec Wise Installer log file
    [2 byte offset]
    2D 6C 68
     [2 byte offset]
    -lh
    LHA, LZH Compressed archive file
    2E 52 45 43 .REC
    IVR RealPlayer video file (V11 and later)
    2E 52 4D 46 .RMF
    RM, RMVB RealMedia streaming media file
    2E 52 4D 46 00 00 00 12
    00
     .RMF....
    .
    RA RealAudio file
    2E 72 61 FD 00 .raý.
    RA RealAudio streaming media file
    2E 73 6E 64 .snd
    AU NeXT/Sun Microsystems µ-Law audio file
    30 0
    CAT Microsoft security catalog file
    30 00 00 00 4C 66 4C 65 0...LfLe
    EVT Windows Event Viewer file
    30 26 B2 75 8E 66 CF 11
    A6 D9 00 AA 00 62 CE 6C
     0&²u.fÏ.
    ¦Ù.ª.bÎl
    ASF, WMA, WMV Microsoft Windows Media Audio/Video File
    (Advanced Streaming Format)
    30 31 4F 52 44 4E 41 4E
    43 45 20 53 55 52 56 45
    59 20 20 20 20 20 20 20
     01ORDNAN
    CE SURVE
    Y
    NTF National Transfer Format Map File
    30 37 30 37 30 nn 07070.
    n/a Archive created with the cpio utility (where nn
    values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
    standard ASCII format, new ASCII (aka SVR4) format, and CRC
    format, respectively. (The swpackage(8) page has additional
    information.) (Thanks to F. Webber for this....)
    31 BE or 
    32 BE 
    WRI Microsoft Write file
    34 CD B2 A1 4Ͳ¡
    n/a Extended tcpdump (libpcap) capture file (Linux/Unix)
    37 7A BC AF 27 1C 7z¼¯'.
    7Z 7-Zip compressed file
    37 E4 53 96 C9 DB D6 07 7äS–ÛÖ.
    n/a zisofs compression format, recognized by some Linux kernels. See the
    libburnia page for additional information.
    38 42 50 53 8BPS
    PSD Photoshop image file
    3A 56 45 52 53 49 4F 4E :VERSION
    SLE Surfplan kite project file
    3C <
    ASX Advanced Stream redirector file
    XDR BizTalk XML-Data Reduced Schema file
    3C 21 64 6F 63 74 79 70 <!doctyp
    DCI AOL HTML mail file
    3C 3F 78 6D 6C 20 76 65
    72 73 69 6F 6E 3D
     <?xml ve
    rsion=
    MANIFEST Windows Visual Stylesheet XML file
    3C 3F 78 6D 6C 20 76 65
    72 73 69 6F 6E 3D 22 31
    2E 30 22 3F 3E
     <?xml ve
    rsion="1
    .0"?>
    XUL XML User Interface Language file
    3C 3F 78 6D 6C 20 76 65
    72 73 69 6F 6E 3D 22 31
    2E 30 22 3F 3E 0D 0A 3C
    4D 4D 43 5F 43 6F 6E 73
    6F 6C 65 46 69 6C 65 20
    43 6F 6E 73 6F 6C 65 56
    65 72 73 69 6F 6E 3D 22
     <?xml ve
    rsion="1
    .0"?>..<
    MMC_Cons
    oleFile
    ConsoleV
    ersion="
    MSC Microsoft Management Console Snap-in Control file
    3C 4D 61 6B 65 72 46 69
    6C 65 20
     <MakerFi
    le
    FM, MIF Adobe FrameMaker file
    [24 byte offset]
    3E 00 03 00 FE FF 09 00
    06
     [24 byte offset]
    >...þÿ..
    .
    WB3 Quatro Pro for Windows 7.0 Notebook file
    3F 5F 03 00 ?_..
    GID Windows Help index file
    HLP Windows Help file
    [32 byte offset]
    40 40 40 20 00 00 40 40
    40 40
     [32 byte offset]
    @@@ ..@@
    @@
    ENL EndNote Library File
    41 43 31 30 AC10
    DWG Generic AutoCAD drawing
    NOTES on AutoCAD file headers: The 0x41-43-31-30 (AC10) is a generic header, occupying the first
    four bytes in the file. The next two bytes give further indication about the version or subtype:
    • 0x30-32 (02) — AutoCAD R2.5
    • 0x30-33 (03) — AutoCAD R2.6
    • 0x30-34 (04) — AutoCAD R9
    • 0x30-36 (06) — AutoCAD R10
    • 0x30-39 (09) — AutoCAD R11/R12
    • 0x31-30 (10) — AutoCAD R13 (subtype 10)
    • 0x31-31 (11) — AutoCAD R13 (subtype 11)
    • 0x31-32 (12) — AutoCAD R13 (subtype 12)
    • 0x31-33 (13) — AutoCAD R14 (subtype 13)
    • 0x31-34 (14) — AutoCAD R14 (subtype 14)
    • 0x31-35 (15) — AutoCAD R2000
    • 0x31-38 (18) — AutoCAD R2004
    • 0x32-31 (21) — AutoCAD R2007
    41 43 76 ACL
    SLE Steganos Security Suite virtual secure drive
    41 43 53 44 ACSD
    n/a Miscellaneous AOL parameter and information files
    41 45 53 AES
    AES AES Crypt file format. (The fourth byte is the version number.)
    41 4D 59 4F AMYO
    SYW Harvard Graphics symbol graphic
    41 4F 4C 20 46 65 65 64
    62 61 67
     AOL Feed
    bag
    BAG AOL and AIM buddy list file
    41 4F 4C 44 42 AOLDB
    ABY, IDX AOL database files: address book (ABY) and user configuration
    data (MAIN.IDX)
    41 4F 4C 49 44 58 AOLIDX
    IND AOL client preferences/settings file (MAIN.IND)
    41 4F 4C 49 4E 44 45 58 AOLINDEX
    ABI AOL address book index file
    41 4F 4C 56 4D 31 30 30 AOLVM100
    ORG, PFC AOL personal file cabinet (PFC) file
    41 56 47 36 5F 49 6E 74
    65 67 72 69 74 79 5F 44
    61 74 61 62 61 73 65
     AVG6_Int
    egrity_D
    atabase
    DAT AVG6 Integrity database file
    41 72 43 01 ArC.
    ARC FreeArc compressed file
    42 41 41 44 BAAD
    n/a NTFS Master File Table (MFT) entry (1,024 bytes)
    42 45 47 49 4E 3A 56 43
    41 52 44 0D 0A
     BEGIN:VC
    ARD..
    VCF vCard file
    42 4C 49 32 32 33 51 BLI223Q
    BIN Thomson Speedtouch series WLAN router firmware
    42 4D BM
    BMP, DIB Windows (or device-independent) bitmap image
    NOTE: Bytes 2-5 contain the file length in little-endian order.
    42 4F 4F 4B 4D 4F 42 49 BOOKMOBI
    PRC Palmpilot resource file
    42 5A 68 BZh
    BZ2, TAR.BZ2, TBZ2, TB2 bzip2 compressed archive
    43 23 2B 44 A4 43 4D A5
    48 64 72
     C#+D¤CM¥
    Hdr
    RTD RagTime document file
    43 42 46 49 4C 45 CBFILE
    CBD WordPerfect dictionary file (unconfirmed)
    43 44 30 30 31 CD001
    ISO ISO-9660 CD Disc Image
    This signature usually occurs at byte offset 32769 (0x8001),
    34817 (0x8801), or 36865 (0x9001).
    More information can be found at MacTech or at ECMA.
    43 49 53 4F CISO
    CSO Compressed ISO (CISO) CD image
    43 4D 58 31 CMX1
    CLB Corel Binary metafile
    43 4F 4D 2B COM+
    CLB COM+ Catalog file
    43 4F 57 44 COWD
    VMDK VMware 3 Virtual Disk (portion of a split disk) file
    43 50 54 37 46 49 4C 45 CPT7FILE
    CPT Corel Photopaint file
    43 50 54 46 49 4C 45 CPTFILE
    CPT Corel Photopaint file
    43 52 45 47 CREG
    DAT Windows 9x registry hive
    43 52 55 53 48 20 76 CRUSH v
    CRU Crush compressed archive
    43 57 53 CWS
    SWF Shockwave Flash file (v5+)
    43 61 74 61 6C 6F 67 20
    33 2E 30 30 00
     Catalog
    3.00.
    CTF WhereIsIt Catalog file
    43 6C 69 65 6E 74 20 55
    72 6C 43 61 63 68 65 20
    4D 4D 46 20 56 65 72 20
     Client U
    rlCache
    MMF Ver
    DAT IE History (index.dat) file
    44 41 58 00 DAX.
    DAX DAX Compressed CD image
    44 42 46 48 DBFH
    DB Palm Zire photo database
    44 4D 53 21 DMS!
    DMS Amiga DiskMasher compressed archive
    44 4F 53 DOS
    ADF Amiga disk file
    44 56 44 DVD
    DVR DVR-Studio stream file
    IFO DVD info file
    45 4C 49 54 45 20 43 6F
    6D 6D 61 6E 64 65 72 20
     ELITE Co
    mmander
    CDR Elite Plus Commander saved game file
    45 4E 54 52 59 56 43 44
    02 00 00 01 02 00 18 58
     ENTRYVCD
    .......X
    VCD VideoVCD (GNU VCDImager) file
    45 52 46 53 53 41 56 45
    44 41 54 41 46 49 4C 45
     ERFSSAVE
    DATAFILE
    DAT Kroll EasyRecovery Saved Recovery State file
    45 50 EP
    MDI Microsoft Document Imaging file
    45 56 46 09 0D 0A FF 00 EVF...ÿ.
    Enn (where nn are numbers) Expert Witness Compression Format (EWF) file, including EWF-E01
    and EWF-S01, as used in EnCase and SMART evidence files.
    See the EWF specification.
    45 56 46 32 0D 0A 81 EVF2...
    Exnn (where nn are numbers) EnCase® Evidence File Format Version 2 (Ex01).
    See the document.
    45 6C 66 46 69 6C 65 00 ElfFile.
    EVTX Windows Vista event log file
    45 86 00 00 06 00 E†....
    QBB Intuit QuickBooks backup file
    46 41 58 43 4F 56 45 52
    2D 56 45 52
     FAXCOVER
    -VER
    CPE Microsoft Fax Cover Sheet
    46 44 42 48 00 FDBH.
    FDB Fiasco database definition file
    46 45 44 46 FEDF
    SBV (Unknown file type)
    46 49 4C 45 FILE
    n/a NTFS Master File Table (MFT) entry (1,024 bytes)
    46 4C 56 01 FLV.
    FLV Flash video file
    46 4F 52 4D 00 FORM.
    AIFF Audio Interchange File
    DAX DAKX Compressed Audio
    46 57 53 FWS
    SWF Macromedia Shockwave Flash player file
    46 72 6F 6D 20 20 20 or From
    46 72 6F 6D 20 3F 3F 3F or From ???
    46 72 6F 6D 3A 20 From:
    EML A commmon file extension for e-mail files. Signatures shown here
    are for Netscape, Eudora, and a generic signature, respectively.
    EML is also used by Outlook Express and QuickMail.
    47 46 31 50 41 54 43 48 GF1PATCH
    PAT Advanced Gravis Ultrasound patch file
    47 49 46 38 37 61 or GIF87a
    47 49 46 38 39 61 GIF89a
    GIF Graphics interchange format file
    Trailer: 00 3B (.;)
    47 50 41 54 GPAT
    PAT GIMP (GNU Image Manipulation Program) pattern file
    47 58 32 GX2
    GX2 Show Partner graphics file (not confirmed)
    47 65 6E 65 74 65 63 20
    4F 6D 6E 69 63 61 73 74
     Genetec
    Omnicast
    G64 Genetec video archive
    48 48 47 42 31 HHGB1
    SH3 Harvard Graphics presentation file
    49 20 49 I I
    TIF, TIFF Tagged Image File Format file
    49 44 33 ID3
    MP3 MPEG-1 Audio Layer 3 (MP3) audio file
    49 44 33 03 00 00 00 ID3....
    KOZ Sprint Music Store audio file (for mobile devices)
    49 49 1A 00 00 00 48 45
    41 50 43 43 44 52 02 00
     II....HE
    APCCDR..
    CRW Canon digital camera RAW file
    49 49 2A 00 II*.
    TIF, TIFF Tagged Image File Format file (little
    endian, i.e., LSB first in the byte; Intel)
    49 49 2A 00 10 00 00 00
    43 52
     II*.....
    CR
    CR2 Canon digital camera RAW file
    49 53 63 28 ISc(
    CAB, HDR Install Shield v5.x or 6.x compressed file
    49 54 4F 4C 49 54 4C 53 ITOLITLS
    LIT Microsoft Reader eBook file
    49 54 53 46 ITSF
    CHI, CHM Microsoft Compiled HTML Help File
    49 6E 6E 6F 20 53 65 74
    75 70 20 55 6E 69 6E 73
    74 61 6C 6C 20 4C 6F 67
    20 28 62 29
     Inno Set
    up Unins
    tall Log
     (b)
    DAT Inno Setup Uninstall Log file
    49 6E 74 65 72 40 63 74
    69 76 65 20 50 61 67 65
     Inter@ct
    ive Page
    IPD Inter@ctive Pager Backup (BlackBerry) backup file
    (See also IPD File Format page or IPD File for BlackBerry)
    4A 41 52 43 53 00 JARCS.
    JAR JARCS compressed archive
    4A 47 03 0E or JG..
    4A 47 04 0E JG..
    ART AOL ART file
    Trailers:
    For 0x4A-47-03-0E: D0 CB 00 00 (ÐË..)
    For 0x4A-47-04-0E: CF C7 CB (ÏÇË)
    4B 44 4D KDM
    VMDK VMware 4 Virtual Disk (portion of a split disk) file
    4B 44 4D 56 KDMV
    VMDK VMware 4 Virtual Disk (monolitic disk) file
    4B 47 42 5F 61 72 63 68
    20 2D
     KGB_arch
     -
    KGB KGB archive
    4B 49 00 00 KI..
    SHD Windows 9x printer spool file
    4B 57 41 4A 88 F0 27 D1 KWAJˆð'Ñ
    n/a KWAJ file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
    This command compresses a single file, replacing the last character in the file name
    with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
    FOO.BA$. (See the SZDD/KWAJ page for more information.)
    4C 00 00 00 01 14 02 00 L.......
    LNK Windows shortcut file. See also The Meaning of Linkfiles in Forensic Examinations.
    4C 01 L.
    OBJ Microsoft Common Object File Format (COFF) relocatable
    object code file for an Intel 386 or later/compatible processors
    4C 4E 02 00 LN..
    GID Windows Help index file
    HLP Windows Help file.
    4C 56 46 09 0D 0A FF 00 LVF...ÿ.
    Enn (where nn are numbers) Logical File Evidence Format (EWF-L01) as used in later versions of
    EnCase evidence files. See the EWF specification.
    4D 2D 57 20 50 6F 63 6B
    65 74 20 44 69 63 74 69
     M-W Pock
    et Dicti
    PDB Merriam-Webster Pocket Dictionary file
    4D 41 52 31 00 MAR1.
    MAR Mozilla archive
    4D 41 52 43 MARC
    MAR Microsoft/MSN MARC archive
    4D 41 72 30 00 MAr0.
    MAR MAr compressed archive
    4D 44 4D 50 93 A7 MDMP“§
    HDMP Windows heap dump file
    DMP Windows minidump file
    4D 49 4C 45 53 MILES
    MLS Milestones v1.0 project management and scheduling software
    (Also see "MV2C" and "MV214" signatures)
    4D 4C 53 57 MLSW
    MLS Skype localization data file
    4D 4D 00 2A MM.*
    TIF, TIFF Tagged Image File Format file (big
    endian, i.e., LSB last in the byte; Motorola)
    4D 4D 00 2B MM.+
    TIF, TIFF BigTIFF files; Tagged Image File Format files >4 GB
    4D 4D 4D 44 00 00 MMMD..
    MMF Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
    for multimedia files that can be played on hand-held devices.
    4D 52 56 4E MRVN
    NVRAM VMware BIOS (non-volatile RAM) state file.
    4D 53 43 46 MSCF
    CAB Microsoft cabinet file
    PPZ Powerpoint Packaged Presentation
    SNP Microsoft Access Snapshot Viewer file
    4D 53 46 54 02 00 01 00 MSFT....
    TLB OLE, SPSS, or Visual C++ type library file
    4D 53 5F 56 4F 49 43 45 MS_VOICE
    CDR, DVF Sony Compressed Voice File
    MSV Sony Memory Stick Compressed Voice file
    4D 54 68 64 MThd
    MID, MIDI Musical Instrument Digital Interface (MIDI) sound file
    4D 56 MV
    DSN CD Stomper Pro label file
    4D 56 32 31 34 MV214
    MLS Milestones v2.1b project management and scheduling software
    (Also see "MILES" and "MV2C" signatures)
    4D 56 32 43 MV2C
    MLS Milestones v2.1a project management and scheduling software
    (Also see "MILES" and "MV214" signatures)
    4D 5A MZ
    COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS Windows/DOS executable file
    (See The MZ EXE File Format page for the structure of an EXE file,
    with coverage of NE, TLINK, PE, self-extracting archives, and more.)
    ACM MS audio compression manager driver
    AX Library cache file
    CPL Control panel application
    FON Font file
    OCX ActiveX or OLE Custom Control
    OLB OLE object library
    SCR Screen saver
    VBX VisualBASIC application
    VXD, 386 Windows virtual device drivers
    4D 5A 90 00 03 00 00 00 MZ......
    API Acrobat plug-in
    AX DirectShow filter
    FLT Audition graphic filter file (Adobe)
    4D 5A 90 00 03 00 00 00
    04 00 00 00 FF FF
     MZ......
    ....ÿÿ
    ZAP ZoneAlam data file
    4D 69 63 72 6F 73 6F 66
    74 20 43 2F 43 2B 2B 20
     Microsof
    t C/C++
    PDB Microsoft C++ debugging symbols file
    4D 69 63 72 6F 73 6F 66
    74 20 56 69 73 75 61 6C
    20 53 74 75 64 69 6F 20
    53 6F 6C 75 74 69 6F 6E
    20 46 69 6C 65
     Microsof
    t Visual
     Studio
    Solution
     File
    SLN Visual Studio .NET Solution file
    [84 byte offset]
    4D 69 63 72 6F 73 6F 66
    74 20 57 69 6E 64 6F 77
    73 20 4D 65 64 69 61 20
    50 6C 61 79 65 72 20 2D
    2D 20
     [84 byte offset]
    Microsof
    t Window
    s Media
    Player -
    -
    WPL Windows Media Player playlist
    4D 73 52 63 66 MsRcf
    GDB VMapSource GPS Waypoint Database
    4E 41 56 54 52 41 46 46
    49 43
     NAVTRAFF
    IC
    DAT TomTom traffic data file
    4E 42 2A 00 NB*.
    JNT, JTP MS Windows journal file
    4E 45 53 4D 1A 01 NESM..
    NSF NES Sound file
    4E 49 54 46 30 NITF0
    NTF National Imagery Transmission Format (NITF) file
    4E 61 6D 65 3A 20 Name:
    COD Agent newsreader character map file
    4F 50 4C 44 61 74 61 62
    61 73 65 46 69 6C 65
     OPLDatab
    aseFile
    DBF Psion Series 3 Database file
    4F 67 67 53 00 02 00 00
    00 00 00 00 00 00
     OggS....
    ......
    OGA, OGG, OGV, OGX Ogg Vorbis Codec compressed Multimedia file
    4F 7B O{
    DW4 Visio/DisplayWrite 4 text file (unconfirmed)
    50 00 00 00 20 00 00 00 P... ...
    IDX Quicken QuickFinder Information File
    50 35 0A P5.
    PGM Portable Graymap Graphic
    50 41 43 4B PACK
    PAK Quake archive file
    50 41 47 45 44 55 36 34 PAGEDU64
    DMP Windows 64-bit memory dump
    50 41 47 45 44 55 4D 50 PAGEDUMP
    DMP Windows memory dump
    50 41 58 PAX
    PAX PAX password protected bitmap
    50 45 53 54 PEST
    DAT PestPatrol data/scan strings
    50 47 50 64 4D 41 49 4E PGPdMAIN
    PGD PGP disk image
    50 49 43 54 00 08 PICT..
    IMG ADEX Corp. ChromaGraph Graphics Card Bitmap Graphic file
    50 4B 03 04 PK..
    ZIP PKZIP archive file (Ref. 1 | Ref. 2)
    Trailer: filename 50 4B 17 characters 00 00 00
    Trailer: (filename PK 17 characters ...)
    ZIP Apple Mac OS X Dashboard Widget, Aston Shell theme, Oolite eXpansion Pack,
    Opera Widget, Pivot Style Template, Rockbox Theme package, Simple Machines
    Forums theme, SubEthaEdit Mode, Trillian zipped skin, Virtual Skipper skin
    JAR Java archive; compressed file package for classes and data
    KMZ Google Earth saved working session file
    KWD KWord document
    ODT, ODP, OTT OpenDocument text document, presentation, and text document template, respectively.
    SXC, SXD, SXI, SXW OpenOffice spreadsheet (Calc), drawing (Draw), presentation (Impress),
    and word processing (Writer) files, respectively.
    SXC StarOffice spreadsheet
    WMZ Windows Media compressed skin file
    XPI Mozilla Browser Archive
    XPS XML paper specification file
    XPT eXact Packager Models
    50 4B 03 04 14 00 01 00
    63 00 00 00 00 00
     PK......
    c.....
    ZIP ZLock Pro encrypted ZIP
    50 4B 03 04 14 00 06 00 PK......
    DOCX, PPTX, XLSX Microsoft Office Open XML Format (OOXML) Document
    NOTE: There is no subheader for MS OOXML files as there is with
    DOC, PPT, and XLS files. To better understand the format of these files,
    rename any OOXML file to have a .ZIP extension and then unZIP the file;
    look at the resultant file named [Content_Types].xml to see the content
    types. In particular, look for the <Override PartName= tag, where you
    will find wordppt, or xl, respectively.

    Trailer: Look for 50 4B 05 06 (PK..) followed by 18 additional bytes
    at the end of the file.
    50 4B 03 04 14 00 08 00
    08 00
     PK......
    ..
    JAR Java archive
    50 4B 05 06 PK..
    50 4B 07 08 PK..
    ZIP PKZIP empty and multivolume archive file, respectively
    [30 byte offset]
    50 4B 4C 49 54 45
     [30 byte offset]
    PKLITE
    ZIP PKLITE compressed ZIP archive (see also PKZIP)
    [526 byte offset]
    50 4B 53 70 58
     [526 byte offset]
    PKSFX
    ZIP PKSFX self-extracting executable compressed file (see also PKZIP)
    50 4D 43 43 PMCC
    GRP Windows Program Manager group file
    50 4E 43 49 55 4E 44 4F PNCIUNDO
    DAT Norton Disk Doctor undo file
    [92 byte offset]
    51 45 4C 20
     [92 byte offset]
    QEL
    QEL Quicken data file
    51 46 49 FB QFIû
    IMG QEMU Qcow Disk Image
    51 57 20 56 65 72 2E 20 QW Ver.
    ABD, QSD Quicken data file
    52 41 5A 41 54 44 42 31 RAZATDB1
    DAT Shareaza (Windows P2P client) thumbnail
    52 45 47 45 44 49 54 REGEDIT
    REG, SUD Windows NT Registry and Registry Undo files
    52 45 56 4E 55 4D 3A 2C REVNUM:,
    ADF Antenna data file
    52 49 46 46 RIFF
    ANI Windows animated cursor
    CMX Corel Presentation Exchange (Corel 10 CMX) Metafile
    CDR CorelDraw document
    DAT Video CD MPEG or MPEG1 movie file
    DS4 Micrografx Designer v4 graphic file
    4XM 4X Movie video
    52 49 46 46 xx xx xx xx
    41 56 49 20 4C 49 53 54
     RIFF....
    AVI LIST
    AVI Resource Interchange File Format -- Windows Audio
    Video Interleave file

    52 49 46 46 xx xx xx xx
    43 44 44 41 66 6D 74 20
     RIFF....
    CDDAfmt
    CDA Resource Interchange File Format -- Compact Disc
    Digital Audio (CD-DA) file
    52 49 46 46 xx xx xx xx
    51 4C 43 4D 66 6D 74 20
     RIFF....
    QLCMfmt
    QCP Resource Interchange File Format -- Qualcomm
    PureVoice
    52 49 46 46 xx xx xx xx
    52 4D 49 44 64 61 74 61
     RIFF....
    RMIDdata
    RMI Resource Interchange File Format -- Windows Musical
    Instrument Digital Interface file

    52 49 46 46 xx xx xx xx
    57 41 56 45 66 6D 74 20
     RIFF....
    WAVEfmt
    WAV Resource Interchange File Format -- Audio for
    Windows file

    52 54 53 53 RTSS
    CAP Windows NT Netmon capture file
    52 61 72 21 1A 07 00 Rar!...
    RAR WinRAR compressed archive file
    52 65 74 75 72 6E 2D 50
    61 74 68 3A 20
     Return-P
    ath:
    EML A commmon file extension for e-mail files.
    53 43 48 6C SCHl
    AST Need for Speed: Underground Audio file
    53 43 4D 49 SCMI
    IMG Img Software Set Bitmap
    53 48 4F 57 SHOW
    SHW Harvard Graphics DOS Ver. 2/x Presentation file
    53 49 45 54 52 4F 4E 49
    43 53 20 58 52 44 20 53
    43 41 4E
     SIETRONI
    CS XRD S
    CAN
    CPI Sietronics CPI XRD document
    53 49 54 21 00 SIT!.
    SIT StuffIt compressed archive
    53 4D 41 52 54 44 52 57 SMARTDRW
    SDR SmartDraw Drawing file
    53 50 46 49 00 SPFI.
    SPF StorageCraft ShadownProtect backup file
    53 51 4C 4F 43 4F 4E 56
    48 44 00 00 31 2E 30 00
     SQLOCONV
    HD..1.0.
    CNV DB2 conversion file
    53 51 4C 69 74 65 20 66
    6F 72 6D 61 74 20 33 00
     SQLite f
    ormat 3.
    DB SQLite database file
    53 5A 20 88 F0 27 33 D1 SZ ˆð'3Ñ
    n/a QBASIC SZDD file header variant. (See the SZDD or KWAJ format entries
    for additional information.)
    53 5A 44 44 88 F0 27 33 SZDDˆð'3
    n/a SZDD file format used by DOS COMPRESS.EXE and EXPAND.EXE commands.
    This command compresses a single file, replacing the last character in the file name
    with an underscore or dollar sign, e.g., FOO.BAZ would be renamed FOO.BA_ or
    FOO.BA$. (See the SZDD/KWAJ page for more information.)
    53 6D 62 6C Smbl
    SYM (Unconfirmed file type. Likely type is Harvard Graphics
    Version 2.x graphic symbol or Windows SDK graphic symbol)
    53 74 75 66 66 49 74 20
    28 63 29 31 39 39 37 2D
     StuffIt
    (c)1997-
    SIT StuffIt compressed archive
    53 75 70 65 72 43 61 6C
    63
     SuperCal
    c
    CAL SuperCalc worksheet
    54 68 69 73 20 69 73 20 This is
    INFO UNIX GNU Info Reader File
    55 43 45 58 UCEX
    UCE Unicode extensions
    55 46 41 C6 D2 C1 UFAÆÒÁ
    UFA UFA compressed archive
    55 46 4F 4F 72 62 69 74 UFOOrbit
    DAT UFO Capture v2 map file
    56 43 50 43 48 30 VCPCH0
    PCH Visual C PreCompiled header file
    56 45 52 53 49 4F 4E 20 VERSION
    CTL Visual Basic User-defined Control file
    56 65 72 73 69 6F 6E 20 Version
    MIF MapInfo Interchange Format file
    57 4D 4D 50 WMMP
    DAT Walkman MP3 container file
    57 53 32 30 30 30 WS2000
    WS2 WordStar for Windows Ver. 2 document
    [29,152 byte offset]
    57 69 6E 5A 69 70
     [29,152 byte offset]
    WinZip
    ZIP WinZip compressed archive
    57 6F 72 64 50 72 6F WordPro
    LWP Lotus WordPro document.
    58 2D X-
    EML A commmon file extension for e-mail files. This variant is
    for Exchange.
    58 43 50 00 XCP.
    CAP Cinco NetXRay, Network General Sniffer, and
    Network Associates Sniffer capture file
    58 50 43 4F 4D 0A 54 79
    70 65 4C 69 62
     XPCOM.Ty
    peLib
    XPT XPCOM type libraries for the XPIDL compiler
    58 54 XT..
    BDR MS Publisher border
    5A 4F 4F 20 ZOO
    ZOO ZOO compressed archive
    5B 47 65 6E 65 72 61 6C
    5D 0D 0A 44 69 73 70 6C
    61 79 20 4E 61 6D 65 3D
    3C 44 69 73 70 6C 61 79
    4E 61 6D 65
     [General
    ]..Displ
    ay Name=
    <Display
    Name
    ECF MS Exchange 2007 extended configuration file
    5B 4D 53 56 43 [MSVC
    VCW Microsoft Visual C++ Workbench Information File
    5B 50 68 6F 6E 65 5D [Phone]
    DUN Dial-up networking file
    5B 56 45 52 5D or [VER]
    5B 76 65 72 5D or [ver]
    SAM Lotus AMI Pro document
    [2 byte offset]
    5B 56 65 72 73 69 6F 6E
     [2 byte offset]
    [Version
    CIF (Unknown file type)
    5B 57 69 6E 64 6F 77 73
    20 4C 61 74 69 6E 20
     [Windows
     Latin
    CPX Microsoft Code Page Translation file
    5B 66 6C 74 73 69 6D 2E
    30 5D
     [fltsim.
    0]
    CFG Flight Simulator Aircraft Configuration file
    5B 70 6C 61 79 6C 69 73
    74 5D
     [playlis
    t]
    PLS WinAmp Playlist file
    5F 27 A8 89 _'¨‰
    JAR Jar archive
    5F 43 41 53 45 5F _CASE_
    CAS, CBK EnCase case file (and backup)
    60 EA 
    ARJ Compressed archive file
    62 65 67 69 6E begin
    n/a UUencoded files start with a string:
      begin mode path
    where mode is the set of permissions as used in
    Linux/Unix and path is the name given to the decoded
    file. (See this uuencode page for more information.)
    62 70 6C 69 73 74 bplist
    plist Binary property list (plist)
    (NOTE: Next two bytes are the version number, currently
    0x30-30, or "00")
    63 6F 6E 65 63 74 69 78 conectix
    VHD Virtual PC Virtual HD image
    63 75 73 68 00 00 00 02
    00 00 00
     cush....
    ...
    CSH Photoshop Custom Shape
    64 00 00 00 d...
    P10 Intel PROset/Wireless Profile
    64 65 78 0A 30 30 39 00 dex.009.
    dex Dalvik executable file (Android)
    64 73 77 66 69 6C 65 dswfile
    DSW Microsoft Visual Studio workspace file
    64 6E 73 2E dns.
    AU Audacity audio file
    66 49 00 00 fI..
    -
    SHD Windows NT printer spool file
    66 4C 61 43 00 00 00 22 fLaC..."
    FLAC Free Lossless Audio Codec file
    67 49 00 00 gI..
    -
    SHD Windows 2000/XP printer spool file
    68 49 00 00 hI..
    -
    SHD Windows Server 2003 printer spool file
    6C 33 33 6C l33l
    DBB Skype user data file (profile and contacts)
    [4 byte offset]
    6D 6F 6F 76
     [4 byte offset]
    moov
    MOV QuickTime movie file
    .MOV files have a complicated file signature. The string "moov" is the most common but I have also seen:
      0x66-72-65-65   free
      0x6D-64-61-74   mdat
      0x77-69-64-65   wide

    And the following have been reported to me:
      0x70-6E-6F-74   pnot
      0x73-6B-69-70   skip

    Furthermore, if you look at byte position xxxxxxxx+4 (where xxxxxxxx is bytes 0-3 of the header), you
    will find one (or more!) of these strings repeated; the string "freeseems to be the most common. For
    more information, see the QuickTime File Format page. (Thanks to D. Wright for getting me started on this!)
    6F 3C o<
    n/a Short Message Service (SMS), or text, message stored on a
    Subscriber Identification Module (SIM).
    72 65 67 66 regf
    DAT Windows NT registry hive file
    72 69 66 66 riff
    ACD Sonic Foundry Acid Music File (Sony)
    72 74 73 70 3A 2F 2F rtsp://
    RAM RealMedia metafile
    73 6C 68 21 or slh!
    73 6C 68 2E slh.
    DAT Allegro Generic Packfile Data file (0x21 = compressed,
    0x2E = uncompressed)
    73 6D 5F sm_
    PDB PalmOS SuperMemo file
    73 72 63 64 6F 63 69 64
    3A
     srcdocid
    :
    CAL CALS raster bitmap file
    73 7A 65 7A szez
    PDB PowerBASIC Debugger Symbols file
    [60 byte offset]
    74 42 4D 50 4B 6E 57 72
     [60 byte offset]
    tBMPKnWr
    PRC PathWay Map file, used with GPS devices
    [257 byte offset]
    75 73 74 61 72
     [257 byte offset]
    ustar
    TAR Tape Archive file (http://www.mkssoftware.com/docs/man4/tar.4.asp)
    76 32 30 30 33 2E 31 30
    0D 0A 30 0D 0A
     v2003.10
    ..0..
    FLT Qimage filter
    78 x
    DMG Mac OS X Disk Copy Disk Image file
    7A 62 65 78 zbex
    INFO ZoomBrowser Image Index file (ZbThumbnal.info)
    7B 0D 0A 6F 20 {..o
    LGC, LGD Windows application log
    7B 5C 70 77 69 {\pwi
    PWI Microsoft Windows Mobile personal note file
    7B 5C 72 74 66 31 {\rtf1
    RTF Rich text format word processing file
    Trailer: 5C 70 61 72 20 7D 7D (\par }})
    7E 42 4B 00 ~BK.
    PSP Corel Paint Shop Pro image file
    7F 45 4C 46 .ELF
    n/a Executable and Linking Format executable file (Linux/Unix)
    80 .
    OBJ Relocatable object code
    80 00 00 20 03 12 04 .......
    ADX Dreamcast audio file
    81 32 84 C1 85 05 D0 11
    B2 90 00 AA 00 3C F6 76
     .2„Á….Ð.
    ²..ª.<öv
    WAB Outlook Express address book (Win95)
    81 CD AB .Í«
    WPF WordPerfect text file
    89 50 4E 47 0D 0A 1A 0A ‰PNG....
    PNG Portable Network Graphics file
    Trailer: 49 45 4E 44 AE 42 60 82 (IEND®B`‚...)
    8A 01 09 00 00 00 E1 08
    00 00 99 19
     Š.....á.
    ..™.
    AW MS Answer Wizard file
    91 33 48 46 ‘3HF
    HAP Hamarsoft HAP 3.x compressed archive
    95 00 or •.
    95 01 •.
    SKR PGP secret keyring file
    99 
    GPG GNU Privacy Guard (GPG) public keyring
    99 01 ™.
    PKR PGP public keyring file
    9C CB CB 8D 13 75 D2 11
    91 58 00 C0 4F 79 56 A4
     œËË..UÒ.
    ‘X.ÀOyV¤
    WAB Outlook address file
    [512 byte offset]
    A0 46 1D F0
     [512 byte offset]
     F.ð
    PPT PowerPoint presentation subheader (MS Office)
    A1 B2 C3 D4 ¡²ÃÔ
    n/a tcpdump (libpcap) capture file (Linux/Unix)
    A1 B2 CD 34 ¡²Í4
    n/a Extended tcpdump (libpcap) capture file (Linux/Unix)
    A9 0D 00 00 00 00 00 00 ©.......
    DAT Access Data FTK evidence file
    AC 9E BD 8F 00 00 ¬.½...
    QDF Quicken data file
    AC ED ¬í
    n/a Java serialization data (see Object Serialization Stream Protocol)
    AC ED 00 05 73 72 00 12
    62 67 62 6C 69 74 7A 2E
     ¬í..sr..
    bgblitz.
    PDB BGBlitz (professional Backgammon software) position database file
    B0 4D 46 43 °MFC
    PWL Windows 95 password file
    B1 68 DE 3A ±hÞ:
    DCX Graphics Multipage PCX bitmap file
    B4 6E 68 44 ´nhd
    TIB Acronis True Image file
    B5 A2 B0 B3 B3 B0 A5 B5 µ¢°³³°¥µ
    CAL Windows calendar file
    BE 00 00 00 AB 00 00 00
    00 00 00 00 00
     ¾...«...
    ....
    WRI MS Write file
    C3 AB CD AB Ã«Í«
    ACS MS Agent Character file
    C5 D0 D3 C6 ÅÐÓÆ
    EPS Adobe encapsulated PostScript file
    C8 00 79 00 È.y.
    LBK Jeppesen FliteLog file
    CA FE BA BE Êþº¾
    CLASS Java bytecode file
    CD 20 AA AA 02 00 00 00 Í ªª....
    n/a Norton Anti-Virus quarantined virus file
    CF 11 E0 A1 B1 1A E1 00 Ï.ࡱ.á.
    DOC Perfect Office document
    [Note similarity to MS Office header, below]
    CF AD 12 FE Ï­.þ
    DBX Outlook Express e-mail folder
    D0 CF 11 E0 A1 B1 1A E1 ÐÏ.ࡱ.á
    DOC, DOT, PPS, PPT, XLA, XLS, WIZ Microsoft Office applications (Word, Powerpoint, Excel, Wizard)
    [See also Word, Powerpoint, and Excel "subheaders" at byte offset 512]
    [Note the similarity between D0 CF 11 E0 and the word "docfile"!]
    AC_ CaseWare Working Papers compressed client file
    ADP Access project file
    APR Lotus/IBM Approach 97 file
    DB MSWorks database file
    MSC Microsoft Common Console Document
    MSI Microsoft Installer package
    MTW Minitab data file
    OPT Developer Studio File Workspace Options file
    PUB MS Publisher file
    QBM QuickBooks Portable Company File
    RVT Revit Project file
    SOU Visual Studio Solution User Options file
    SPO SPSS output file
    VSD Visio file
    WPS MSWorks text document
    D2 0A 00 00 Ò...
    FTR GN Nettest WinPharoah filter file
    D4 2A Ô*
    ARL, AUT AOL history (ARL) and typed URL (AUT) files
    D4 C3 B2 A1 Ôò¡
    n/a WinDump (winpcap) capture file (Windows)
    D7 CD C6 9A ×ÍÆš
    WMF Windows graphics metafile
    DB A5 2D 00 Û¥-.
    DOC Word 2.0 file
    DC DC ÜÜ
    CPL Corel color palette file
    DC FE Üþ
    EFX eFax file format
    E3 10 00 01 00 00 00 00 ã.......
    INFO Amiga Icon file
    E3 82 85 96 ã‚…–
    PWL Windows 98 password file
    E4 52 5C 7B 8C D8 A7 4D
    AE B1 53 78 D0 29 96 D3
     äR\{ŒØ§M
    ®±SxÐ)–Ó
    ONE Microsoft OneNote note
    E8 or è
    E9 or é
    EB ë
    COM, SYS Windows executable file
    EB 3C 90 2A ë<.*
    IMG GEM Raster file
    [512 byte offset]
    EC A5 C1 00
     [512 byte offset]
    ì¥Á.
    DOC Word document subheader (MS Office)
    ED AB EE DB í«îÛ
    RPM RedHat Package Manager file
    EF BB BF ï»¿
    n/a Byte-order mark for 8-bit Unicode Transformation Format
    (UTF-8) files. (See the Unicode Home Page.)
    [At a cluster boundary]
    F0 FF FF
     [At a cluster boundary]
    ðÿÿ
    n/a FAT12 File Allocation Table
    [At a cluster boundary]
    F8 FF FF FF
     [At a cluster boundary]
    øÿÿÿ
    n/a FAT16 File Allocation Table
    [At a cluster boundary]
    F8 FF FF 0F FF FF FF FF
     [At a cluster boundary]
    øÿÿ.ÿÿÿÿ
    n/a FAT32 File Allocation Table
    [512 byte offset]
    FD FF FF FF 04
     [512 byte offset]
    ýÿÿÿ.
    QBM QuickBooks Portable Company File
    SUO Visual Studio Solution User Options subheader (MS Office)
    [512 byte offset]
    FD FF FF FF nn 00 00 00
     [512 byte offset]
    ýÿÿÿ....
    PPT PowerPoint presentation subheader (MS Office)
    (where nn has been seen with values 0x0E, 0x1C, and 0x43)
    [512 byte offset]
    FD FF FF FF nn 00
     [512 byte offset]
    ýÿÿÿ..
    or
    [512 byte offset]
    FD FF FF FF nn 02
     [512 byte offset]
    ýÿÿÿ..
    XLS Excel spreadsheet subheader (MS Office)
    (where nn = 0x10, 0x1F, 0x22, 0x23, 0x28, or 0x29)
    [512 byte offset]
    FD FF FF FF 20 00 00 00
     [512 byte offset]
    ýÿÿÿ ...
    OPT Developer Studio File Workspace Options subheader (MS Office)
    XLS Excel spreadsheet subheader (MS Office)
    [512 byte offset]
    FD FF FF FF xx xx xx xx
    xx xx xx xx 04 00 00 00
     [512 byte offset]
    ýÿÿÿ....
    ........
    DB Thumbs.db subheader (MS Office)
    FE EF þï
    GHO, GHS Symantex Ghost image file
    FE FF þÿ
    n/a Byte-order mark for 16-bit Unicode Transformation Format/
    2-octet Universal Character Set (UTF-16/UCS-2), little-endian files.
    (See the Unicode Home Page.)
    FF ÿ
    SYS Windows executable (SYS) file
    FF 00 02 00 04 04 05 54
    02 00
     ÿ......T
    ..
    WKS Works for Windows spreadsheet file
    FF 46 4F 4E 54 ÿFONT
    CPI Windows international code page
    FF 4B 45 59 42 20 20 20 ÿKEYB
    SYS Keyboard driver file
    FF 57 50 43 ÿWPC
    WP, WPD, WPG, WPP, WP5, WP6 WordPerfect text and graphics file
    FF D8 FF E0 xx xx 4A 46
    49 46 00
     ÿØÿà..JF
    IF.
    JFIF, JPE, JPEG, JPG JPEG/JFIF graphics file
    Trailer: FF D9 (ÿÙ)
    FF D8 FF E1 xx xx 45 78
    69 66 00
     ÿØÿá..Ex
    if.
    JPG Digital camera JPG using Exchangeable Image File Format (EXIF)
    Trailer: FF D9 (ÿÙ)
    See "Using Extended File Information (EXIF) File Headers in Digital
    Evidence Analysis"
     (P. Alvarez, IJDE2(3), Winter 2004) and
    ExifTool Tag Names

    FF D8 FF E8 xx xx 53 50
    49 46 46 00
     ÿØÿè..SP
    IFF.
    JPG Still Picture Interchange File Format (SPIFF)
    Trailer: FF D9 (ÿÙ)
    NOTES on JPEG file headers: It appears that one can safely say that all JPEG files start with the three hex digits 0xFF-D8-FF.
    The fourth digit is also indicative of JPEG content. Various options include:
    FF Ex ÿ.
    FF Fx ÿ.
    MPEG, MPG, MP3 MPEG audio file frame synch pattern
    FF FE ÿþ
    REG Windows Registry file
    n/a Byte-order mark for 16-bit Unicode Transformation Format/
    2-octet Universal Character Set (UTF-16/UCS-2), big-endian files.
    (See the Unicode Home Page.)
    FF FE 00 00 ÿþ..
    n/a Byte-order mark for 32-bit Unicode Transformation Format/
    4-octet Universal Character Set (UTF-32/UCS-4), little-endian files.
    (See the Unicode Home Page.)
    FF FE 23 00 6C 00 69 00
    6E 00 65 00 20 00 31 00
     ÿþ#.l.i.
    n.e. .1.
    MOF Windows MSinfo file
    FF FF FF FF ÿÿÿÿ
    SYS DOS system driver

    ACKNOWLEDGEMENTS
    The following individuals have given me updates or suggestions for this list over the years: Devon Ackerman, Nazim Aliyev, Vladimir Benko, Arvin Bhatnagar, Sam Brothers, Per Christensson, Cornelis de Groot, Jeffrey Duggan, Jean-Pierre Fiset, Peter Almer Frederiksen, Tim Gardner, Paulo Guzmán, George Harpur, Brian High, Eric Huber, Broadus Jones, Axel Kesseler, Nick Khor, Bill Kuhns, Anand Mani, Kevin Mansell, Davyd McColl, Michal, Bruce Modick, Lee Nelson, Dan P., Jorge Paulhiac, Carlo Politi, Stanley Rainey, Cory Redfern, Bruce Robertson, Thomas Rösner, Mike Sutton, Matthias Sweertvaegher, Jason Wallace, Erik van de Burgwal, Franklin Webber, Gavin Williams, Mike Wilkinson, and David Wright. I thank them and apologize if I have missed anyone.
    I would like to give particular thanks to Danny Mares of Mares and Company, author of the MaresWare Suite (primarily for the "subheaders" for many of the file types here), and the people at X-Ways Forensics for their permission to incorporate their lists of file signatures.