Cheat Sheets Forensics

File Signatures (Magic Bytes) Table

Magic bytes of images, documents, archives, media, executables and forensic artefacts: hex signature, offset and extension, common ones checked on real files.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

A file's first bytes say what it really is, whatever its extension claims. The common signatures below (images, archives, audio, video, ELF, SQLite, WebAssembly, pcap) were checked by generating real files and running them through file(1), and the others follow the format specifications. The common ones also match the signature table used by Binary & Archive Forensics. Offsets are in bytes from the start of the file; .. stands for a byte that varies. For the background, see How File Signatures (Magic Bytes) Work.

Images

Format Signature (hex) As text Offset Extension
PNG 89 50 4E 47 0D 0A 1A 0A .PNG.... 0 .png
JPEG FF D8 FF ÿØÿ 0 .jpg, .jpeg
GIF 47 49 46 38 37 61 or 47 49 46 38 39 61 GIF87a, GIF89a 0 .gif
BMP 42 4D BM 0 .bmp
WebP 52 49 46 46 .. .. .. .. 57 45 42 50 RIFF....WEBP 0 .webp
TIFF (little-endian) 49 49 2A 00 II*. 0 .tif, .tiff
TIFF (big-endian) 4D 4D 00 2A MM.* 0 .tif, .tiff
ICO 00 00 01 00 0 .ico
Photoshop 38 42 50 53 8BPS 0 .psd
JPEG 2000 00 00 00 0C 6A 50 20 20 0D 0A 87 0A ....jP .... 0 .jp2
AVIF 66 74 79 70 61 76 69 66 ftypavif 4 .avif
HEIC / HEIF 66 74 79 70 68 65 69 63 (or brand mif1, heix) ftypheic 4 .heic, .heif

Documents and data

Format Signature (hex) As text Offset Extension
PDF 25 50 44 46 2D %PDF- 0 .pdf
OLE2 compound file (legacy Office, MSI, Outlook) D0 CF 11 E0 A1 B1 1A E1 0 .doc, .xls, .ppt, .msi, .msg
Office Open XML, OpenDocument, EPUB 50 4B 03 04 PK.. 0 .docx, .xlsx, .pptx, .odt, .epub
Rich Text Format 7B 5C 72 74 66 31 {\rtf1 0 .rtf
PostScript 25 21 50 53 %!PS 0 .ps, .eps
SQLite 3 database 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 SQLite format 3. 0 .sqlite, .db
X.509 certificate (DER) 30 82 0. 0 .der, .cer
PEM (certificate, key) 2D 2D 2D 2D 2D 42 45 47 49 4E -----BEGIN 0 .pem, .crt, .key
KeePass 2 database 03 D9 A2 9A 67 FB 4B B5 0 .kdbx

Office Open XML and EPUB files are ZIP archives, so the signature alone only says "ZIP". Look inside: a DOCX has [Content_Types].xml and a word/ folder, while an EPUB stores the text mimetypeapplication/epub+zip starting at byte 30.

Archives and compression

Format Signature (hex) As text Offset Extension
ZIP (normal) 50 4B 03 04 PK.. 0 .zip, .jar, .apk
ZIP (empty archive) 50 4B 05 06 PK.. 0 .zip
ZIP (spanned) 50 4B 07 08 PK.. 0 .zip
gzip 1F 8B (then 08 for deflate) 0 .gz, .tgz
bzip2 42 5A 68 BZh 0 .bz2
xz FD 37 7A 58 5A 00 .7zXZ. 0 .xz
Zstandard 28 B5 2F FD 0 .zst
LZ4 frame 04 22 4D 18 0 .lz4
7-Zip 37 7A BC AF 27 1C 7z.... 0 .7z
RAR 4.x 52 61 72 21 1A 07 00 Rar!... 0 .rar
RAR 5 52 61 72 21 1A 07 01 00 Rar!.... 0 .rar
TAR (POSIX / GNU) 75 73 74 61 72 ustar 257 .tar
Microsoft Cabinet 4D 53 43 46 MSCF 0 .cab
cpio (newc) 30 37 30 37 30 31 070701 0 .cpio
Debian package (ar) 21 3C 61 72 63 68 3E 0A !<arch>. 0 .deb, .a
RPM package ED AB EE DB 0 .rpm
ISO 9660 disc image 43 44 30 30 31 CD001 32769 (0x8001) .iso

TAR has no signature at byte 0: POSIX archives carry ustar followed by 00 30 30, GNU tar writes ustar followed by two spaces and 00.

Audio and video

Format Signature (hex) As text Offset Extension
WAV 52 49 46 46 .. .. .. .. 57 41 56 45 RIFF....WAVE 0 .wav
AVI 52 49 46 46 .. .. .. .. 41 56 49 20 RIFF....AVI 0 .avi
AIFF 46 4F 52 4D .. .. .. .. 41 49 46 46 FORM....AIFF 0 .aif, .aiff
FLAC 66 4C 61 43 fLaC 0 .flac
Ogg (Vorbis, Opus) 4F 67 67 53 OggS 0 .ogg, .opus
MP3 with ID3v2 tag 49 44 33 ID3 0 .mp3
MP3 without tag FF FB (also FF F3, FF F2) 0 .mp3
MIDI 4D 54 68 64 MThd 0 .mid
MP4, MOV, M4A (ISO base media) 66 74 79 70 ftyp 4 .mp4, .mov, .m4a
Matroska, WebM 1A 45 DF A3 0 .mkv, .webm
Flash Video 46 4C 56 01 FLV. 0 .flv
MPEG program stream 00 00 01 BA 0 .mpg
MPEG transport stream 47 repeated every 188 bytes G 0 .ts

ISO base media files share ftyp; the four bytes after it (the brand) name the flavour: isom (MP4), qt (QuickTime), M4A (iTunes audio), avif, heic.

Executables and code

Format Signature (hex) As text Offset Extension
Windows PE (EXE, DLL, SYS) 4D 5A MZ 0 .exe, .dll, .sys
ELF (Linux, Android native) 7F 45 4C 46 .ELF 0 none, .so, .o
Mach-O 64-bit (little-endian) CF FA ED FE 0 none, .dylib
Mach-O 32-bit (little-endian) CE FA ED FE 0 none
Mach-O (big-endian) FE ED FA CE / FE ED FA CF 0 none
Mach-O universal (fat) CA FE BA BE 0 none
Java class CA FE BA BE 0 .class
Android DEX 64 65 78 0A 30 33 35 00 dex.035. 0 .dex
WebAssembly 00 61 73 6D .asm 0 .wasm
Script with shebang 23 21 #! 0 .sh, .py, none

MZ is only the DOS stub: a real PE file stores the offset of its 50 45 00 00 (PE..) header in the 4 bytes at 0x3C. Java classes and Mach-O universal binaries share CA FE BA BE; the next 4 bytes tell them apart (a small architecture count for Mach-O, a class-file version for Java). Inspect either with Executable Forensics.

Forensic and system artefacts

Artefact Signature (hex) As text Offset Extension
Windows registry hive 72 65 67 66 regf 0 NTUSER.DAT, SYSTEM, .hve
Windows event log 45 6C 66 46 69 6C 65 00 ElfFile. 0 .evtx
Windows shortcut 4C 00 00 00 01 14 02 00 L....... 0 .lnk
Windows minidump 4D 44 4D 50 MDMP 0 .dmp
pcap (little-endian) D4 C3 B2 A1 0 .pcap
pcap (big-endian) A1 B2 C3 D4 0 .pcap
pcapng 0A 0D 0D 0A 0 .pcapng
VMware disk 4B 44 4D 56 KDMV 0 .vmdk
Hyper-V disk 76 68 64 78 66 69 6C 65 vhdxfile 0 .vhdx
QEMU disk 51 46 49 FB QFI. 0 .qcow2

End-of-file markers

Format Trailer (hex) As text
JPEG FF D9
PNG 49 45 4E 44 AE 42 60 82 IEND + CRC
GIF 3B ;
PDF 25 25 45 4F 46 (often followed by a newline) %%EOF
ZIP 50 4B 05 06 + 18 bytes (+ comment) PK..

Carving tools use these trailers to find where a file ends. Data after the trailer (a ZIP appended to a JPEG, several %%EOF from incremental PDF saves) is a classic thing to look for with Image Forensics and Document Forensics.

Try these tools

Binary &amp; Archive Forensics

Inspect any file's true type by magic bytes, carve embedded files at any offset.

Executable Forensics

Inspect Windows PE, Linux ELF and macOS Mach-O executables in your browser - headers, sections with per-section entropy, imports/exports.

Document Forensics

Analyze PDF and Office documents in your browser - reconstruct a PDF's incremental-save revision history.

Image Forensics

Analyze photos for tampering with ELA, noise analysis, clone detection and EXIF metadata extraction.

MIME Type Lookup

Look up a MIME type from a file extension, or find the file extension(s) for a MIME type.

See also

  • Glossary Magic bytes
    Magic bytes, or a file signature, are the fixed bytes at the start of a file that identify its true format regardless of its name or.
  • Glossary File carving
    File carving is recovering files from raw storage by searching for their start and end signatures.
  • Guide How File Signatures (Magic Bytes) Work
    How the first bytes of a file identify its real type, a table of common signatures verified against real files.
  • Cheat sheet MIME Types Cheat Sheet
    The MIME types for web pages, data, images, audio, video, fonts and archives.
  • Glossary Hexadecimal
    Hexadecimal (hex) is the base-16 number system, using digits 0-9 and letters A-F, widely used as a compact way to write binary data.
Back to the cheat sheets
AdSense Placeholder
Slot: footer_leaderboard