1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
|
#------------------------------------------------------------------------------
# $File: sql,v 1.24 2022/07/17 15:32:48 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
# Recognize some MySQL files.
# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
#
0 beshort 0xfe01 MySQL table definition file
>2 byte x Version %d
>3 byte 0 \b, type UNKNOWN
>3 byte 1 \b, type DIAM_ISAM
>3 byte 2 \b, type HASH
>3 byte 3 \b, type MISAM
>3 byte 4 \b, type PISAM
>3 byte 5 \b, type RMS_ISAM
>3 byte 6 \b, type HEAP
>3 byte 7 \b, type ISAM
>3 byte 8 \b, type MRG_ISAM
>3 byte 9 \b, type MYISAM
>3 byte 10 \b, type MRG_MYISAM
>3 byte 11 \b, type BERKELEY_DB
>3 byte 12 \b, type INNODB
>3 byte 13 \b, type GEMINI
>3 byte 14 \b, type NDBCLUSTER
>3 byte 15 \b, type EXAMPLE_DB
>3 byte 16 \b, type CSV_DB
>3 byte 17 \b, type FEDERATED_DB
>3 byte 18 \b, type BLACKHOLE_DB
>3 byte 19 \b, type PARTITION_DB
>3 byte 20 \b, type BINLOG
>3 byte 21 \b, type SOLID
>3 byte 22 \b, type PBXT
>3 byte 23 \b, type TABLE_FUNCTION
>3 byte 24 \b, type MEMCACHE
>3 byte 25 \b, type FALCON
>3 byte 26 \b, type MARIA
>3 byte 27 \b, type PERFORMANCE_SCHEMA
>3 byte 127 \b, type DEFAULT
>0x0033 ulong x \b, MySQL version %d
0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
>3 byte x Version %d
>14 beshort x \b, %d key parts
>16 beshort x \b, %d unique key parts
>18 byte x \b, %d keys
>28 bequad x \b, %lld records
>36 bequad x \b, %lld deleted records
0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file
>3 byte x Version %d
0 belong&0xffffff00 0xfefe0c00
>4 string MACF MySQL Maria control file
>>3 byte x Version %d
0 string \376bin MySQL replication log,
>9 long x server id %d
>8 byte 1
>>13 long 69 \b, MySQL V3.2.3
>>>19 string x \b, server version %s
>>13 long 75 \b, MySQL V4.0.2-V4.1
>>>25 string x \b, server version %s
>8 byte 15 MySQL V5+,
>>25 string x server version %s
>4 string MARIALOG MySQL Maria transaction log file
>>3 byte x Version %d
#------------------------------------------------------------------------------
# iRiver H Series database file
# From Ken Guest <ken@linux.ie>
# As observed from iRivNavi.iDB and unencoded firmware
#
0 string iRivDB iRiver Database file
>11 string >\0 Version %s
>39 string iHP-100 [H Series]
#------------------------------------------------------------------------------
# SQLite database files
# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
#
# Version 1 used GDBM internally; its files cannot be distinguished
# from other GDBM files.
#
# Version 2 used this format:
0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
# URL: https://en.wikipedia.org/wiki/SQLite
# Reference: https://www.sqlite.org/fileformat.html
# Update: Joerg Jenderek
# Version 3 of SQLite allows applications to embed their own "user version"
# number in the database at offset 60. Later, SQLite added an "application id"
# at offset 68 that is preferred over "user version" for indicating the
# associated application.
#
0 string SQLite\ format\ 3
# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size
>16 ubeshort >0 SQLite 3.x
# deprecated
#!:mime application/x-sqlite3
!:mime application/vnd.sqlite3
# seldom found extension sqlite3 like in SyncData.sqlite3
# db
# db3 like: AddrBook.db3 cgipcrvp.db3
# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase
# help is used for newer Maple help database
# SQLite database weewx.sdb used by weather software weewx
# https://www.weewx.com/docs/usersguide.htm
# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
# Unfortunately extension sqlite also used for other databases starting with string
# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
# and with string "ZV-zlib" in like extra.sqlite
>>68 belong !0x5CDE09EF database
!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
>>68 belong =0x5CDE09EF database
# maple is used for Maple Workbook
!:ext maple
>>60 belong =0x5f4d544e (Monotone source repository)
# if no known user version then check for Application IDs with default clause
>>60 belong !0x5f4d544e
# The "Application ID" set by PRAGMA application_id
>>>68 belong =0x0f055112 (Fossil checkout)
>>>68 belong =0x0f055113 (Fossil global configuration)
>>>68 belong =0x0f055111 (Fossil repository)
>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database)
>>>68 belong =0x42654c6e (Bentley Systems Localization File)
>>>68 belong =0x47504b47 (OGC GeoPackage file)
# https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt
>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file)
>>>68 belong =0x45737269 (Esri Spatially-Enabled Database)
>>>68 belong =0x4d504258 (MBTiles tileset)
# https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
>>>68 belong =0x5CDE09EF (Maple Workbook)
# unknown application ID
>>>68 default x
>>>>68 belong !0 \b, application id %u
# The "user version" as read and set by the user_version pragma like:
# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
>>60 belong !0 \b, user version %d
# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
>>96 belong x \b, last written using SQLite version %d
# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
# like: 512 1024 often 4096 32768
>>16 ubeshort !4096 \b, page size %u
# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
>>18 ubyte !1 \b, writer version %u
# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite
>>19 ubyte !1 \b, read version %u
# Bytes of unused "reserved" space at the end of each page. Usually 0
>>20 ubyte !0 \b, unused bytes %u
# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite
>>21 ubyte !64 \b, maximum payload %u
# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite
>>22 ubyte !32 \b, minimum payload %u
# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite
>>23 ubyte !32 \b, leaf payload %u
# file change counter
>>24 ubelong x \b, file counter %u
# Size of the database file in pages
>>28 ubelong x \b, database pages %u
# page number of the first freelist trunk page like: 0 2 3 4 5 9
# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659
>>32 ubelong !0 \b, 1st free page %u
# total number of freelist pages
>>36 ubelong !0 \b, free pages %u
# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8
>>40 ubelong x \b, cookie %#x
# the schema format number. Supported formats are 1 2 3 and often 4
# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird)
>>44 ubelong x \b, schema %u
# Suggested cache size like: 0 2000
>>48 ubelong !0 \b, cache page size %u
# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise.
>>52 ubelong !0 \b, largest root page %u
# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be
#>>56 ubelong x \b, encoding %u
>>56 ubelong x
>>>56 ubelong =1 \b, UTF-8
>>>56 ubelong =2 \b, UTF-16 little endian
>>>56 ubelong =3 \b, UTF-16 big endian
# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird)
# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html
>>>56 default x
>>>>56 ubelong x \b, unknown %#x encoding
# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy
>>64 ubelong !0 \b, vacuum mode %u
# Reserved for expansion. Must be zero
>>72 uquad !0 \b, reserved %#llx
# The version-valid-for number like:
# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh
>>92 ubelong x \b, version-valid-for %u
# SQLite Write-Ahead Log from SQLite version >= 3.7.0
# https://www.sqlite.org/fileformat.html#walformat
0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log,
!:ext sqlite-wal/db-wal
>4 belong x version %d
# SQLite Rollback Journal
# https://www.sqlite.org/fileformat.html#rollbackjournal
0 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal
# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
# https://github.com/PredatH0r/ChanSort
0 string PSDB\0 Panasonic channel list DataBase
!:ext db/bin
#!:mime application/x-db-svl-panasonic
>126 string SQLite\ format\ 3
#!:mime application/x-panasonic-sqlite3
>>&-15 indirect x \b; contains
# H2 Database from https://www.h2database.com/
0 string --\ H2\ 0.5/B\ --\ \n H2 Database file
# DuckDB database file from https://duckdb.org
8 string DUCK DuckDB database file
>12 lequad x \b, version %lld
#>20 lequad x \b, flags %#llx
#>28 lequad x \b, flags %#llx
|
