ole2compounddocs 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760
  1. #------------------------------------------------------------------------------
  2. # $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $
  3. # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
  4. # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  5. # Additional tests for OLE 2 Compound Documents should be under this recipe.
  6. # reference: https://www.openoffice.org/sc/compdocfileformat.pdf
  7. 0 string \320\317\021\340\241\261\032\341
  8. # https://digital-preservation.github.io/droid/
  9. # skip droid skeleton like fmt-39-signature-id-128.doc by valid version
  10. >0x1A ushort !0xABAB OLE 2 Compound Document
  11. #>0x1C uleshort x \b, endnian %#4.4x
  12. # big endian not tested
  13. >>0x1C ubeshort =0xfffe \b, big-endian
  14. >>>546 string jbjb : Microsoft Word Document
  15. !:mime application/msword
  16. !:apple MSWDWDBN
  17. !:ext doc
  18. # Byte Order 0xFFFE means little-endian found in real world applications
  19. #>>0x1C uleshort =0xfffe \b, little-endian
  20. >>0x1C uleshort =0xfffe
  21. # From: Joerg Jenderek
  22. # Major Version 3 or 4
  23. >>>0x1A uleshort x \b, v%u
  24. # Minor Version 32h=50 3Bh=59 3Eh=62
  25. >>>0x18 uleshort x \b.%u
  26. # SecID of first sector of the directory stream is often 1 but high like 3144h
  27. >>>48 ulelong x \b, SecID %#x
  28. # Sector Shift Exponent in short-stream container stream: 6~64 bytes
  29. >>>32 uleshort !6 \b, exponent of short stream %u
  30. # total number of sectors used for the FAT
  31. >>>44 ulelong >1 \b, %u FAT sectors
  32. # SecID of first sector of the short-sector allocation table (Mini FAT)
  33. # or -2 (End Of ChainSecID) if not extant
  34. >>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x
  35. # total number of sectors used for the short-sector allocation table
  36. >>>64 ulelong !1 \b, %u Mini FAT sector
  37. # plural s
  38. >>>>64 ulelong >1 \bs
  39. # SecID of first sector of the master sector allocation table (DIFAT)
  40. # or -2 (End Of Chain SecID) if no additional sectors used
  41. >>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x
  42. # total number of sectors used for the master sector allocation table (DIFAT)
  43. >>>72 ulelong >0 \b, %u DIFAT sectors
  44. # First part of the master sector allocation table (DIFAT) containing 109 SecIDs
  45. #>>>76 ubequad x \b, DIFAT=%#16.16llx
  46. #>>>84 ubequad x \b%16.16llx...
  47. # pointer to root entry only works with standard configuration for SecID ~< 800h
  48. # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
  49. # "ORLEN Factbook 2017.xls" XnView_metadata.doc
  50. # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
  51. >>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
  52. # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
  53. >>>0x1E uleshort 0xc \b, blocksize 4096
  54. # jump to one block (4096 bytes per block) before root storage block
  55. >>>>(48.l*4096) ubyte x
  56. >>>>>&4095 use ole2-directory
  57. #>>>0x1E uleshort 9 \b, blocksize 512
  58. >>>0x1E uleshort 9
  59. # jump to one block (512 bytes per block) before root storage block
  60. # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
  61. >>>>(48.l*512) ubyte x
  62. >>>>>&511 use ole2-directory
  63. # check directory entry structure and display types by GUID
  64. 0 name ole2-directory
  65. # directory entry name like "Root Entry"
  66. #>0 lestring16 x \b, 1st %.10s
  67. # type of the entry; 5~Root storage
  68. #>66 ubyte x \b, type %x
  69. # node colour of the entry: 00H ~ Red 01H ~ Black
  70. #>67 ubyte x \b, color %x
  71. # the DirIDs of the child nodes. Should both be -1 in the root storage entry
  72. #>68 bequad !0xffffffffffffffff \b, DirIDs %llx
  73. # NEXT lines for DEBUGGING
  74. # second directory entry name like VisioDocument Control000
  75. #>128 lestring16 x \b, 2nd %.20s
  76. # third directory entry like WordDocument
  77. #>256 lestring16 x \b, 3rd %.20s
  78. # forth
  79. #>384 lestring16 x \b, 4th %.10s
  80. # 5th
  81. #>512 lestring16 x \b, 5th %.10s
  82. # 6th
  83. #>640 lestring16 x \b, 6th %.10s
  84. # 7th
  85. #>768 lestring16 x \b, 7th %.10s
  86. # https://wikileaks.org/ciav7p1/cms/page_13762814.html
  87. # https://m.blog.naver.com/superman4u/40047693679
  88. # https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
  89. # https://toolslick.com/conversion/data/guid
  90. #>80 ubequad !0 \b, clsid %#16.16llx
  91. #>>88 ubequad x \b%16.16llx
  92. # test for "Root Entry" inside directory by type 5 value
  93. >66 ubyte 5
  94. # look for CLSID GUID 0
  95. >>88 ubequad 0x0
  96. >>>80 ubequad 0x0
  97. # - Microstation V8 DGN files (www.bentley.com)
  98. # URL: https://en.wikipedia.org/wiki/MicroStation
  99. # Last update on 10/23/2006 by Lester Hightower
  100. # 07/24/2019 by Joerg Jenderek
  101. # Second directory entry name like Dgn~H Dgn~S
  102. >>>>128 lestring16 Dgn~ : Microstation V8 CAD
  103. #!:mime application/x-ole-storage
  104. !:mime application/x-bentley-dgn
  105. # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
  106. !:ext dgn
  107. #
  108. # URL: http://fileformats.archiveteam.org/wiki/WordPerfect
  109. # Second directory entry name PerfectOffice_
  110. >>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic
  111. !:mime application/vnd.wordperfect
  112. # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
  113. !:apple ????WPC7
  114. !:ext mst/wpd/wpg
  115. #
  116. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  117. # Second directory entry name MatOST_
  118. >>>>128 lestring16 MatOST : Microsoft Works 3.0 document
  119. !:mime application/vnd.ms-works
  120. !:apple ????AWWP
  121. !:ext wps
  122. #
  123. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
  124. # 3rd directory entry name WksSSWorkBook
  125. >>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet
  126. !:mime application/vnd.ms-works
  127. !:apple ????AWSS
  128. !:ext xlr
  129. #
  130. # URL: http://fileformats.archiveteam.org/wiki/XLS
  131. # what is the difference to {00020820-0000-0000-c000-000000000046} ?
  132. # Second directory entry name Workbook
  133. >>>>128 lestring16 Workbook
  134. >>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid
  135. !:mime application/vnd.ms-excel
  136. # https://www.macdisk.com/macsigen.php XLS5 for Excel 5
  137. !:apple ????XLS9
  138. !:ext xls
  139. #
  140. # URL: http://fileformats.archiveteam.org/wiki/PPT
  141. # Second directory entry name Object1 Object12 Object35
  142. >>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation
  143. !:mime application/vnd.ms-powerpoint
  144. # https://www.macdisk.com/macsigen.php
  145. !:apple ????PPT3
  146. !:ext ppt
  147. #
  148. # URL: https://www.msoutlook.info/question/164
  149. # Second directory entry name __CollDataStm
  150. >>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings
  151. #!:mime application/vnd.ms-outlook
  152. !:mime application/x-ms-srs
  153. # %APPDATA%\Microsoft\Outlook\Outlook.srs
  154. !:ext srs
  155. #
  156. # URL: https://www.file-extensions.org/cag-file-extension
  157. # Second directory entry name Category
  158. >>>>128 lestring16 Category : Microsoft Clip Art Gallery
  159. #!:mime application/x-ole-storage
  160. !:mime application/x-ms-cag
  161. !:apple MScgCGdb
  162. !:ext cag/
  163. #
  164. # URL: https://www.filesuffix.com/de/extension/rra
  165. # 3rd directory entry name StrIndex_StringTable
  166. >>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer
  167. #!:mime application/x-ole-storage
  168. !:mime application/x-ms-rra
  169. !:ext rra
  170. #
  171. # URL: https://www.forensicswiki.org/wiki/Jump_Lists
  172. # 3rd directory entry name DestList
  173. >>>>256 lestring16 DestList : Windows jump list
  174. #!:mime application/x-ole-storage
  175. !:mime application/x-ms-jumplist
  176. # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
  177. !:ext automaticDestinations-ms
  178. #
  179. # URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache
  180. # Second directory entry name 256_
  181. >>>>128 lestring16 256_ : Windows thumbnail database 256
  182. #!:mime application/x-ole-storage
  183. !:mime application/x-ms-thumbnail
  184. # Thumbs.db
  185. !:ext db
  186. >>>>128 lestring16 96_ : Windows thumbnail database 96
  187. !:mime application/x-ms-thumbnail
  188. !:ext db
  189. # 3rd directory entry name Catalog_
  190. >>>>256 lestring16 Catalog : Windows thumbnail database
  191. !:mime application/x-ms-thumbnail
  192. !:ext db
  193. #
  194. # URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
  195. # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
  196. # Second directory entry name Control000
  197. >>>>128 lestring16 Control000 : Microsoft old Systeminfo
  198. #!:mime application/x-ole-storage
  199. !:mime application/x-ms-info
  200. !:ext nfo
  201. #
  202. # From: Joerg Jenderek
  203. # URL: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  204. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml
  205. # Note: older versions til 13 about middle 2021 handled by ./windows
  206. # called "Sysinternals Autoruns data (v14)" by TrID
  207. # second, third and fourth directory entry name like Header Items 0
  208. >>>>128 lestring16 Header : Microsoft sysinternals AutoRuns data, version 14
  209. #!:mime application/x-ole-storage
  210. !:mime application/x-ms-arn
  211. # like: MyHOSTNAME.arn
  212. !:ext arn
  213. #
  214. # From: Joerg Jenderek
  215. # URL: https://en.wikipedia.org/wiki/Microsoft_Access
  216. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
  217. # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  218. # Note: only version foo tested and called "Microsoft Access Wizard template" by TrID
  219. # Fourth directory entry name TemplateID
  220. >>>>384 lestring16 TemplateID : Microsoft Access wizard template
  221. # Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
  222. #!:mime application/x-ole-storage
  223. #!:mime application/vnd.ms-office
  224. #!:mime application/vnd.ms-access
  225. #!:mime application/msaccess
  226. !:mime application/x-ms-mdz
  227. # http://extension.nirsoft.net/mdz
  228. !:ext mdz
  229. #
  230. # URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
  231. # Second directory entry name Thumbnail
  232. >>>>128 lestring16 Thumbnail : Corel PrintHouse image
  233. #!:mime application/x-ole-storage
  234. !:mime application/x-corel-cph
  235. !:ext cph
  236. # 3rd directory entry name Thumbnail
  237. >>>>256 lestring16 Thumbnail : Corel PrintHouse image
  238. !:mime application/x-corel-cph
  239. !:ext cph
  240. # URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery
  241. # Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
  242. # third directory entry name _INFO_
  243. >>>>256 lestring16 _INFO_ : Corel Gallery
  244. # second directory entry name _ITEM_ or _DATA_
  245. # later directory entry names: _ALBUM_ _THUMBNAIL_
  246. #!:mime application/x-ole-storage
  247. !:mime application/x-corel-gal
  248. !:ext gal
  249. #
  250. # From: Joerg Jenderek
  251. # URL: https://archive.org/details/iPhoto-Plus-4
  252. # https://filext.com/file-extension/TPL
  253. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml
  254. # Note: found in Template sub directory in program directory of software iPhoto Plus version 4
  255. # second, third and fourth directory entry name like TplHeader TplMainImage TplPreview
  256. >>>>128 lestring16 TplHeader : Ulead iPhoto Template
  257. #!:mime application/x-ole-storage
  258. !:mime image/x-ulead-tpl
  259. # https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template
  260. !:ext tpl
  261. #
  262. # URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
  263. # https://www.hancom.com/etc/hwpDownload.do
  264. # Note: "HWP Document File" signature found in FileHeader
  265. # Hangul Word Processor WORDIAN, 2002 and later is using HWP 5.0 format.
  266. # Second directory entry name FileHeader hint for Thinkfree Office document
  267. >>>>128 lestring16 FileHeader : Hancom HWP (Hangul Word Processor) file, version 5.0
  268. #!:mime application/haansofthwp
  269. !:mime application/x-hwp
  270. # https://example-files.online-convert.com/document/hwp/example.hwp
  271. !:ext hwp
  272. #
  273. # URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
  274. # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
  275. >>>>128 lestring16 dd2 : StarOffice Gallery view
  276. #!:mime application/x-ole-storage
  277. !:mime application/x-star-sdv
  278. !:ext sdv
  279. # URL: https://en.wikipedia.org/wiki/SoftMaker_Office
  280. # second directory entry name Current User
  281. >>>>128 lestring16 Current\ User : SoftMaker
  282. # third directory entry name SMNativeObjData
  283. >>>>>256 lestring16 SMNativeObjData
  284. # 5th directory entry name PowerPoint
  285. >>>>>>512 lestring16 PowerPoint PowerPoint presentation or template
  286. !:mime application/vnd.ms-powerpoint
  287. !:ext ppt/pps/pot
  288. # 4th directory entry name PowerPoint
  289. >>>>>384 lestring16 PowerPoint Presentations or template
  290. # http://extension.nirsoft.net/prv
  291. !:mime application/vnd.softmaker.presentations
  292. !:ext prd/prv
  293. # third directory entry name like Current User
  294. >>>>256 lestring16 Current\ User : SoftMaker
  295. # 5th directory entry name PowerPoint
  296. >>>>>512 lestring16 PowerPoint Presentations or template
  297. # http://extension.nirsoft.net/prd
  298. !:mime application/vnd.softmaker.presentations
  299. !:ext prd/prv
  300. # 2nd directory entry name Pictures
  301. >>>>>>128 lestring16 Pictures with pictures
  302. #
  303. # URL: http://fileformats.archiveteam.org/wiki/PageMaker
  304. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/p
  305. # pagemaker-generic.trid.xml
  306. # pagemaker-pm6.trid.xml
  307. # pagemaker-pm65.trid.xml
  308. # pmd-pm7.trid.xml
  309. # From: Joerg Jenderek
  310. # Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
  311. # verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
  312. # Second directory entry name PageMaker
  313. >>>>128 lestring16 PageMaker :
  314. # look for magic of "old" PageMaker like in 02TEMPLT.T65
  315. >>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99
  316. # GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
  317. #>>>>>>&0 use PageMaker
  318. # THIS WORKS PARTLY!
  319. >>>>>>&0 indirect x
  320. # remaining null clsid
  321. >>>>128 default x
  322. >>>>>0 use ole2-unknown
  323. # look for CLSID where "second" part is 0
  324. >>>80 ubequad !0x0
  325. #
  326. # Summary: Family Tree Maker
  327. # From: Joerg Jenderek
  328. # URL: http://fileformats.archiveteam.org/wiki/Family_Tree_Maker
  329. # https://en.wikipedia.org/wiki/Family_Tree_Maker
  330. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftw.trid.xml
  331. # Note called "Family Tree Maker Family Tree" by TrID and
  332. # "FamilyTree Maker Database" with version "1-4" by DROID via PUID fmt/1352
  333. # tested only with version 2.0
  334. # verified by Michal Mutl Structured Storage Viewer `SSView.exe my.ftw`
  335. # newer versions are SQLite based and handled by ./sql
  336. # directory names like: IND.DB AUX.DB GENERAL.DB NAME.NDX BIRTH.NDX EXTRA.DB
  337. >>>>80 ubequad 0x5702000000000000 : Family Tree Maker Windows database, version 1-4
  338. # look for "File Format (C) Copyright 1993 Banner Blue Software Inc. - All Rights Reserved" in GENERAL.DB
  339. #>>>>>0 search/0x5460c/s F\0i\0l\0e\0\040\0F\0o\0r\0m\0a\0t\0\040\0(\0C\0)\0 \b, VERSION
  340. # GRR: jump to version value like 2 does not work!
  341. #>>>>>>&-8 ubyte x %u
  342. #!:mime application/x-ole-storage
  343. !:mime application/x-fmt
  344. # FBK is used for backup of FTW
  345. !:ext ftw/fbk
  346. #
  347. >>>>80 default x
  348. >>>>>0 use ole2-unknown
  349. # look for known clsid GUID
  350. # - Visio documents
  351. # URL: http://fileformats.archiveteam.org/wiki/Visio
  352. # Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
  353. >>88 ubequad 0xc000000000000046
  354. >>>80 ubequad 0x131a020000000000 : Microsoft Visio 2000-2002 Document, stencil or template
  355. !:mime application/vnd.visio
  356. # VSD~Drawing VSS~Stencil VST~Template
  357. !:ext vsd/vss/vst
  358. >>>80 ubequad 0x141a020000000000 : Microsoft Visio 2003-2010 Document, stencil or template
  359. !:mime application/vnd.visio
  360. !:ext vsd/vss/vst
  361. #
  362. # URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
  363. # https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation
  364. # Update: Joerg Jenderek
  365. # Windows Installer Package *.MSI or validation module *.CUB
  366. >>>80 ubequad 0x84100c0000000000 : Microsoft Windows Installer Package or validation module
  367. !:mime application/x-msi
  368. #!:mime application/x-ms-win-installer
  369. # https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices
  370. # cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub
  371. #!:mime application/x-ms-cub
  372. !:ext msi/cub
  373. # From: Joerg Jenderek
  374. # URL: http://en.wikipedia.org/wiki/Windows_Installer
  375. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mst.trid.xml
  376. # called "Windows SDK Setup Transform script" by TrID
  377. >>>80 ubequad 0x82100c0000000000 : Microsoft Windows Installer transform script
  378. #!:mime application/x-ole-storage
  379. !:mime application/x-ms-mst
  380. !:ext mst
  381. >>>80 ubequad 0x86100c0000000000 : Microsoft Windows Installer Patch
  382. # ??
  383. !:mime application/x-wine-extension-msp
  384. #!:mime application/x-ms-msp
  385. !:ext msp
  386. #
  387. # URL: http://fileformats.archiveteam.org/wiki/DOC
  388. >>>80 ubequad 0x0009020000000000 : Microsoft Word 6-95 document or template
  389. !:mime application/msword
  390. # for template MSWDW8TN
  391. !:apple MSWDWDBN
  392. !:ext doc/dot
  393. >>>80 ubequad 0x0609020000000000 : Microsoft Word 97-2003 document or template
  394. !:mime application/msword
  395. !:apple MSWDWDBN
  396. # dot for template; no extension on Macintosh
  397. !:ext doc/dot/
  398. #
  399. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  400. >>>80 ubequad 0x0213020000000000 : Microsoft Works 3-4 document or template
  401. !:mime application/vnd.ms-works
  402. !:apple ????AWWP
  403. # ps for template https://filext.com/file-extension/PS bps for backup
  404. !:ext wps/ps/bps
  405. #
  406. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
  407. >>>80 ubequad 0x0313020000000000 : Microsoft Works 3-4 database or template
  408. !:mime application/vnd.ms-works-db
  409. # https://www.macdisk.com/macsigen.php
  410. !:apple ????AWDB
  411. # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
  412. !:ext wdb/db/bdb
  413. #
  414. # URL: https://en.wikipedia.org/wiki/Microsoft_Excel
  415. >>>80 ubequad 0x1008020000000000 : Microsoft Excel 5-95 worksheet, addin or template
  416. !:mime application/vnd.ms-excel
  417. # https://www.macdisk.com/macsigen.php
  418. !:apple ????XLS5
  419. # worksheet/addin/template/no extension on Macintosh
  420. !:ext xls/xla/xlt/
  421. #
  422. >>>80 ubequad 0x2008020000000000 : Microsoft Excel 97-2003
  423. !:mime application/vnd.ms-excel
  424. # https://www.macdisk.com/macsigen.php XLS5 for Excel 5
  425. !:apple ????XLS9
  426. # 3rd directory entry name
  427. >>>>256 lestring16 _VBA_PROJECT_CUR addin
  428. !:ext xla/
  429. # 4th directory entry name
  430. >>>>384 lestring16 _VBA_PROJECT_CUR addin
  431. !:ext xla
  432. #!:ext xla/
  433. >>>>256 default x worksheet or template
  434. !:ext xls/xlt
  435. #!:ext xls/xlt/
  436. #
  437. # URL: http://fileformats.archiveteam.org/wiki/OLE2
  438. >>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 item
  439. #>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 Message
  440. #!:mime application/vnd.ms-outlook
  441. !:mime application/x-ms-msg
  442. !:ext msg
  443. # URL: https://wiki.fileformat.com/email/oft/
  444. >>>80 ubequad 0x46f0060000000000 : Microsoft Outlook 97-2003 item template
  445. #!:mime application/vnd.ms-outlook
  446. !:mime application/x-ms-oft
  447. !:ext oft
  448. #
  449. # URL: http://fileformats.archiveteam.org/wiki/PPT
  450. >>>80 ubequad 0x5148040000000000 : Microsoft PowerPoint 4.0 presentation
  451. !:mime application/vnd.ms-powerpoint
  452. # https://www.macdisk.com/macsigen.php
  453. !:apple ????PPT3
  454. !:ext ppt
  455. # Summary: "newer" Greenstreet Art drawing
  456. # From: Joerg Jenderek
  457. # URL: http://fileformats.archiveteam.org/wiki/GST_ART
  458. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml
  459. # Note: called like "Greenstreet Art drawing" by TrID
  460. # Note: CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16
  461. # verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART`
  462. >>>80 ubequad 0x602c020000000000 : Greenstreet Art drawing
  463. #!:mime application/x-ole-storage
  464. !:mime image/x-greenstreet-art
  465. !:ext art
  466. >>>80 default x
  467. >>>>0 use ole2-unknown
  468. #??
  469. # URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
  470. >>88 ubequad 0xa29a00aa004a1a72 : Microsoft
  471. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  472. >>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document
  473. !:mime application/vnd.ms-works
  474. !:apple ????AWWP
  475. !:ext wps
  476. #
  477. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
  478. >>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database
  479. !:mime application/vnd.ms-works-db
  480. !:apple ????AWDB
  481. !:ext wdb/bdb
  482. #??
  483. >>88 ubequad 0xa40700c04fb932ba : Microsoft
  484. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  485. >>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document
  486. !:mime application/vnd.ms-works
  487. !:apple ????AWWP
  488. !:ext wps
  489. # From: Joerg Jenderek
  490. # URL: https://en.wikipedia.org/wiki/Microsoft_Works
  491. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  492. # Note: probably version 6 and 7
  493. # organize pictures like JPFG images in streams __cf1 with names like
  494. # 001.JPG, 002.JPG ... in streams __fname
  495. >>88 ubequad 0xa1c800c04f612452 : Microsoft
  496. >>>80 ubequad 0xc0c7266eb98cd311 Works portfolio
  497. # 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
  498. #!:mime application/x-ole-storage
  499. # https://www.iana.org/assignments/media-types/application/vnd.ms-works
  500. !:mime application/vnd.ms-works
  501. # https://extension.nirsoft.net/wsb
  502. # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
  503. !:ext wsb
  504. #??
  505. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
  506. >>88 ubequad 0x00c0000000000046 : Microsoft
  507. >>>80 ubequad 0x0112020000000000 Publisher
  508. !:mime application/vnd.ms-publisher
  509. !:ext pub
  510. #
  511. # URL: http://fileformats.archiveteam.org/wiki/PPT
  512. #??
  513. >>88 ubequad 0xa90300aa00510ea3 : Microsoft
  514. >>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation
  515. !:mime application/vnd.ms-powerpoint
  516. # https://www.macdisk.com/macsigen.php
  517. !:apple ????PPT3
  518. !:ext ppt/pot
  519. #??
  520. >>88 ubequad 0x86ea00aa00b929e8 : Microsoft
  521. >>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template
  522. !:mime application/vnd.ms-powerpoint
  523. !:apple ????PPT3
  524. # /autostart/template
  525. !:ext ppt/pps/pot
  526. # From: Joerg Jenderek
  527. # URL: https://www.file-extensions.org/ppa-file-extension
  528. # https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
  529. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  530. >>88 ubequad 0x871800aa0060263b : Microsoft
  531. # only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
  532. >>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard
  533. # second, third and fourth directory entry name like VBA PROJECT PROJECTwm
  534. # http://extension.nirsoft.net/pwz
  535. !:mime application/vnd.ms-powerpoint
  536. # like: BSHPPT97.PPA "AutoContent Wizard.pwz"
  537. !:ext ppa/pwz
  538. #
  539. # From: Joerg Jenderek
  540. # URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
  541. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
  542. # Note: called "Microsoft At Work Fax document" by TrID
  543. >>88 ubequad 0xb29400dd010f2bf9 : Microsoft
  544. >>>80 ubequad 0x801cb0023de01a10 At Work fax Document
  545. #!:mime application/x-ole-storage
  546. !:mime image/x-ms-awd
  547. !:ext awd
  548. #
  549. # URL: https://en.wikipedia.org/wiki/Microsoft_Project
  550. #??
  551. >>88 ubequad 0xbe1100c04fb6faf1 : Microsoft
  552. >>>80 ubequad 0x3a8fb774c8c8d111 Project
  553. !:mime application/vnd.ms-project
  554. !:ext mpp
  555. # From: Joerg Jenderek
  556. # URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
  557. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
  558. # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  559. # Note: only version 8 tested and called "Office Binder Document" by TrID and
  560. # "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
  561. >>88 ubequad 0xb21c00aa004ba90b : Microsoft
  562. >>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard
  563. # second directory entry name like Binder
  564. # https://www.file-extensions.org/obd-file-extension
  565. #!:mime application/vnd.ms-binder
  566. !:mime application/x-msbinder
  567. # obt for template; obz for Microsoft Office Binder wizard
  568. !:ext obd/obt/obz
  569. #
  570. # URL: http://fileformats.archiveteam.org/wiki/WordPerfect
  571. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  572. # https://github.com/OneWingedShark/WordPerfect/
  573. # blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
  574. # From: Joerg Jenderek
  575. # Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
  576. # 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
  577. # which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
  578. >>88 ubequad 0x19370000929679cd : WordPerfect 7
  579. >>>80 ubequad 0xff739851ad2d2002 Document
  580. !:mime application/vnd.wordperfect
  581. #!:apple ????WPC?
  582. # https://fossies.org/linux/wp2latex/test/ole6.wpd
  583. !:ext wpd
  584. #>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE
  585. # inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
  586. #>>>>>&0 indirect x \b; contains
  587. # GRR: the above expression does not work correctly
  588. #
  589. # URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
  590. #???
  591. >>88 ubequad 0x99ae04021c007002 : WordPerfect
  592. >>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation
  593. !:mime application/x-corelpresentations
  594. #!:mime application/x-shw-viewer
  595. #!:mime image/x-presentations
  596. !:ext shw
  597. #
  598. # URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
  599. >>>80 ubequad 0x60fe2e4099191b10 9 Graphic
  600. #!:mime application/x-wpg
  601. #!:mime image/x-wordperfect-graphics
  602. !:mime image/x-wpg
  603. # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
  604. !:apple ????WPC9
  605. !:ext wpg
  606. #
  607. # From: Joerg Jenderek
  608. # URL: http://fileformats.archiveteam.org/wiki/CorelCAD
  609. # https://en.wikipedia.org/wiki/CorelCAD
  610. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccd-corelcad.trid.xml
  611. # Note: called "CorelCAD Drawing" by TrID and CorelCAD
  612. # directory entry names like Contents ViewInfo CustomViewDescriptions LayerInfo
  613. >>88 ubequad 0xbe26db67235e2689 : Corel
  614. >>>80 ubequad 0x20f414de1cacce11 \bCAD Drawing or Template
  615. #!:mime application/x-ole-storage
  616. !:mime application/x-corel-cad
  617. # CCT for CorelCAD Template
  618. !:ext ccd/cct
  619. #
  620. # URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
  621. >>88 ubequad 0x996104021c007002 : StarOffice
  622. >>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template
  623. # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
  624. !:mime application/x-starwriter
  625. !:ext sdw/vor
  626. #
  627. >>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template
  628. !:mime application/x-starcalc
  629. !:ext sdc/vor
  630. #
  631. >>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template
  632. !:mime application/x-starimpress
  633. #!:mime application/x-stardraw
  634. # sda ??
  635. !:ext sdd/sda/vor
  636. #??
  637. >>88 ubequad 0x89cb008029e4b0b1 : StarOffice
  638. >>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template
  639. !:mime application/x-starcalc
  640. !:ext sdc/vor
  641. #
  642. >>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template
  643. !:mime application/vnd.stardivision.cal
  644. !:ext sdc/vor
  645. #
  646. >>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template
  647. !:mime application/x-starimpress
  648. !:ext sdd/vor
  649. #??
  650. >>88 ubequad 0xb12a04021c007002 : StarOffice
  651. >>>80 ubequad 0x600459d4fd351c10 StarMath 3.0
  652. !:mime application/x-starmath
  653. !:ext smf
  654. #??
  655. >>88 ubequad 0x8e2c00001b4cc711 : StarOffice
  656. >>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0
  657. !:mime application/x-starchart
  658. !:ext sds
  659. #??
  660. >>88 ubequad 0xa45e00a0249d57b1 : StarOffice
  661. >>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template
  662. !:mime application/x-starwriter
  663. !:ext sdw/vor
  664. #??
  665. >>88 ubequad 0x89ca008029e4b0b1 : StarOffice
  666. >>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0
  667. !:mime application/x-starmath
  668. !:ext smf
  669. #
  670. >>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0
  671. !:mime application/x-starchart
  672. !:ext sds
  673. #??
  674. >>88 ubequad 0xa53f00a0249d57b1 : StarOffice
  675. >>>80 ubequad 0x70c90a340de3d011 Master 4.0 document
  676. !:mime application/x-starwriter-global
  677. !:ext sgl
  678. #??
  679. >>88 ubequad 0x89d0008029e4b0b1 : StarOffice
  680. >>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0
  681. !:mime application/vnd.stardivision.math
  682. !:ext smf
  683. #
  684. >>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template
  685. !:mime application/vnd.stardivision.draw
  686. !:ext sda/vor
  687. #
  688. >>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template
  689. !:mime application/vnd.stardivision.impress
  690. # sda is used for what?
  691. !:ext sdd/vor/sda
  692. #
  693. >>>80 ubequad 0x214388bfdd85d111 StarChart 5.0
  694. !:mime application/vnd.stardivision.chart
  695. !:ext sds
  696. # ??
  697. >>88 ubequad 0xaab4006097da561a : StarOffice
  698. >>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template
  699. !:mime application/vnd.stardivision.writer
  700. !:ext sdw/vor
  701. #
  702. >>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document
  703. !:mime application/vnd.stardivision.writer-global
  704. !:ext sgl
  705. #??
  706. # URL: http://fileformats.archiveteam.org/wiki/FlashPix
  707. >>88 ubequad 0x855300aa00a1f95b : Kodak
  708. >>>80 ubequad 0x0067615654c1ce11 FlashPIX Image
  709. !:mime image/vnd.fpx
  710. !:apple ????FPix
  711. !:ext fpx
  712. # URL: https://en.wikipedia.org/wiki/SoftMaker_Office
  713. >>88 ubequad 0x95f600a0cc3cca14 : PlanMaker
  714. >>>80 ubequad 0x9174088a6452d411 document or template
  715. !:mime application/vnd.softmaker.planmaker
  716. # pmv for template https://www.file-extensions.org/pmv-file-extension
  717. !:ext pmd/pmv
  718. # URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
  719. # https://en.wikipedia.org/wiki/Autodesk_3ds_Max
  720. # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  721. # Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
  722. # "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
  723. # applies only to "newer" versions (about 2008-2020)
  724. >>88 ubequad 0x9fed04143144cc1e : Autodesk
  725. >>>80 ubequad 0x7b8cdd1cc081a045 3ds Max
  726. #!:mime application/x-ole-storage
  727. !:mime model/x-autodesk-max
  728. # like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
  729. !:ext max
  730. # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
  731. #!:ext max/chr
  732. # remaining non null clsid
  733. >>88 default x
  734. >>>0 use ole2-unknown
  735. # display information about directory for not detected CDF files
  736. 0 name ole2-unknown
  737. >80 ubequad x : UNKNOWN
  738. # https://reposcope.com/mimetype/application/x-ole-storage
  739. !:mime application/x-ole-storage
  740. # according to file version 5.41 with -e soft option
  741. #!:mime application/CDFV2
  742. #!:ext ???
  743. >80 ubequad !0 \b, clsid %#16.16llx
  744. >>88 ubequad x \b%16.16llx
  745. # converted hexadecimal format to standard GUUID notation
  746. >>80 guid x {%s}
  747. # second directory entry name like VisioDocument Control000
  748. >128 lestring16 x with names %.20s
  749. # third directory entry like WordDocument Preview.dib
  750. >256 lestring16 x %.20s
  751. # forth like \005SummaryInformation
  752. >384 lestring16 x %.25s
  753. # 5th
  754. >512 lestring16 x %.10s
  755. # 6th
  756. >640 lestring16 x %.10s
  757. # 7th
  758. >768 lestring16 x %.10s