diff options
Diffstat (limited to 'magic/Magdir/ole2compounddocs')
| -rw-r--r-- | magic/Magdir/ole2compounddocs | 760 |
1 files changed, 760 insertions, 0 deletions
diff --git a/magic/Magdir/ole2compounddocs b/magic/Magdir/ole2compounddocs new file mode 100644 index 0000000..2c451a9 --- /dev/null +++ b/magic/Magdir/ole2compounddocs @@ -0,0 +1,760 @@ + +#------------------------------------------------------------------------------ +# $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $ +# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured +# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) +# Additional tests for OLE 2 Compound Documents should be under this recipe. +# reference: https://www.openoffice.org/sc/compdocfileformat.pdf + +0 string \320\317\021\340\241\261\032\341 +# https://digital-preservation.github.io/droid/ +# skip droid skeleton like fmt-39-signature-id-128.doc by valid version +>0x1A ushort !0xABAB OLE 2 Compound Document +#>0x1C uleshort x \b, endnian %#4.4x +# big endian not tested +>>0x1C ubeshort =0xfffe \b, big-endian +>>>546 string jbjb : Microsoft Word Document +!:mime application/msword +!:apple MSWDWDBN +!:ext doc +# Byte Order 0xFFFE means little-endian found in real world applications +#>>0x1C uleshort =0xfffe \b, little-endian +>>0x1C uleshort =0xfffe +# From: Joerg Jenderek +# Major Version 3 or 4 +>>>0x1A uleshort x \b, v%u +# Minor Version 32h=50 3Bh=59 3Eh=62 +>>>0x18 uleshort x \b.%u +# SecID of first sector of the directory stream is often 1 but high like 3144h +>>>48 ulelong x \b, SecID %#x +# Sector Shift Exponent in short-stream container stream: 6~64 bytes +>>>32 uleshort !6 \b, exponent of short stream %u +# total number of sectors used for the FAT +>>>44 ulelong >1 \b, %u FAT sectors +# SecID of first sector of the short-sector allocation table (Mini FAT) +# or -2 (End Of ChainSecID) if not extant +>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x +# total number of sectors used for the short-sector allocation table +>>>64 ulelong !1 \b, %u Mini FAT sector +# plural s +>>>>64 ulelong >1 \bs +# SecID of first sector of the master sector allocation table (DIFAT) +# or -2 (End Of Chain SecID) if no additional sectors used +>>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x +# total number of sectors used for the master sector allocation table (DIFAT) +>>>72 ulelong >0 \b, %u DIFAT sectors +# First part of the master sector allocation table (DIFAT) containing 109 SecIDs +#>>>76 ubequad x \b, DIFAT=%#16.16llx +#>>>84 ubequad x \b%16.16llx... +# pointer to root entry only works with standard configuration for SecID ~< 800h +# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls +# "ORLEN Factbook 2017.xls" XnView_metadata.doc +# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized +>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB +# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 +>>>0x1E uleshort 0xc \b, blocksize 4096 +# jump to one block (4096 bytes per block) before root storage block +>>>>(48.l*4096) ubyte x +>>>>>&4095 use ole2-directory +#>>>0x1E uleshort 9 \b, blocksize 512 +>>>0x1E uleshort 9 +# jump to one block (512 bytes per block) before root storage block +# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h +>>>>(48.l*512) ubyte x +>>>>>&511 use ole2-directory +# check directory entry structure and display types by GUID +0 name ole2-directory +# directory entry name like "Root Entry" +#>0 lestring16 x \b, 1st %.10s +# type of the entry; 5~Root storage +#>66 ubyte x \b, type %x +# node colour of the entry: 00H ~ Red 01H ~ Black +#>67 ubyte x \b, color %x +# the DirIDs of the child nodes. Should both be -1 in the root storage entry +#>68 bequad !0xffffffffffffffff \b, DirIDs %llx +# NEXT lines for DEBUGGING +# second directory entry name like VisioDocument Control000 +#>128 lestring16 x \b, 2nd %.20s +# third directory entry like WordDocument +#>256 lestring16 x \b, 3rd %.20s +# forth +#>384 lestring16 x \b, 4th %.10s +# 5th +#>512 lestring16 x \b, 5th %.10s +# 6th +#>640 lestring16 x \b, 6th %.10s +# 7th +#>768 lestring16 x \b, 7th %.10s +# https://wikileaks.org/ciav7p1/cms/page_13762814.html +# https://m.blog.naver.com/superman4u/40047693679 +# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt +# https://toolslick.com/conversion/data/guid +#>80 ubequad !0 \b, clsid %#16.16llx +#>>88 ubequad x \b%16.16llx +# test for "Root Entry" inside directory by type 5 value +>66 ubyte 5 +# look for CLSID GUID 0 +>>88 ubequad 0x0 +>>>80 ubequad 0x0 +# - Microstation V8 DGN files (www.bentley.com) +# URL: https://en.wikipedia.org/wiki/MicroStation +# Last update on 10/23/2006 by Lester Hightower +# 07/24/2019 by Joerg Jenderek +# Second directory entry name like Dgn~H Dgn~S +>>>>128 lestring16 Dgn~ : Microstation V8 CAD +#!:mime application/x-ole-storage +!:mime application/x-bentley-dgn +# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn +!:ext dgn +# +# URL: http://fileformats.archiveteam.org/wiki/WordPerfect +# Second directory entry name PerfectOffice_ +>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic +!:mime application/vnd.wordperfect +# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd +!:apple ????WPC7 +!:ext mst/wpd/wpg +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +# Second directory entry name MatOST_ +>>>>128 lestring16 MatOST : Microsoft Works 3.0 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet +# 3rd directory entry name WksSSWorkBook +>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet +!:mime application/vnd.ms-works +!:apple ????AWSS +!:ext xlr +# +# URL: http://fileformats.archiveteam.org/wiki/XLS +# what is the difference to {00020820-0000-0000-c000-000000000046} ? +# Second directory entry name Workbook +>>>>128 lestring16 Workbook +>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 +!:apple ????XLS9 +!:ext xls +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +# Second directory entry name Object1 Object12 Object35 +>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt +# +# URL: https://www.msoutlook.info/question/164 +# Second directory entry name __CollDataStm +>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-srs +# %APPDATA%\Microsoft\Outlook\Outlook.srs +!:ext srs +# +# URL: https://www.file-extensions.org/cag-file-extension +# Second directory entry name Category +>>>>128 lestring16 Category : Microsoft Clip Art Gallery +#!:mime application/x-ole-storage +!:mime application/x-ms-cag +!:apple MScgCGdb +!:ext cag/ +# +# URL: https://www.filesuffix.com/de/extension/rra +# 3rd directory entry name StrIndex_StringTable +>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer +#!:mime application/x-ole-storage +!:mime application/x-ms-rra +!:ext rra +# +# URL: https://www.forensicswiki.org/wiki/Jump_Lists +# 3rd directory entry name DestList +>>>>256 lestring16 DestList : Windows jump list +#!:mime application/x-ole-storage +!:mime application/x-ms-jumplist +# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms +!:ext automaticDestinations-ms +# +# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache +# Second directory entry name 256_ +>>>>128 lestring16 256_ : Windows thumbnail database 256 +#!:mime application/x-ole-storage +!:mime application/x-ms-thumbnail +# Thumbs.db +!:ext db +>>>>128 lestring16 96_ : Windows thumbnail database 96 +!:mime application/x-ms-thumbnail +!:ext db +# 3rd directory entry name Catalog_ +>>>>256 lestring16 Catalog : Windows thumbnail database +!:mime application/x-ms-thumbnail +!:ext db +# +# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches +# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based +# Second directory entry name Control000 +>>>>128 lestring16 Control000 : Microsoft old Systeminfo +#!:mime application/x-ole-storage +!:mime application/x-ms-info +!:ext nfo +# +# From: Joerg Jenderek +# URL: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml +# Note: older versions til 13 about middle 2021 handled by ./windows +# called "Sysinternals Autoruns data (v14)" by TrID +# second, third and fourth directory entry name like Header Items 0 +>>>>128 lestring16 Header : Microsoft sysinternals AutoRuns data, version 14 +#!:mime application/x-ole-storage +!:mime application/x-ms-arn +# like: MyHOSTNAME.arn +!:ext arn +# +# From: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Microsoft_Access +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml +# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +# Note: only version foo tested and called "Microsoft Access Wizard template" by TrID +# Fourth directory entry name TemplateID +>>>>384 lestring16 TemplateID : Microsoft Access wizard template +# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation +#!:mime application/x-ole-storage +#!:mime application/vnd.ms-office +#!:mime application/vnd.ms-access +#!:mime application/msaccess +!:mime application/x-ms-mdz +# http://extension.nirsoft.net/mdz +!:ext mdz +# +# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House +# Second directory entry name Thumbnail +>>>>128 lestring16 Thumbnail : Corel PrintHouse image +#!:mime application/x-ole-storage +!:mime application/x-corel-cph +!:ext cph +# 3rd directory entry name Thumbnail +>>>>256 lestring16 Thumbnail : Corel PrintHouse image +!:mime application/x-corel-cph +!:ext cph +# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery +# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album +# third directory entry name _INFO_ +>>>>256 lestring16 _INFO_ : Corel Gallery +# second directory entry name _ITEM_ or _DATA_ +# later directory entry names: _ALBUM_ _THUMBNAIL_ +#!:mime application/x-ole-storage +!:mime application/x-corel-gal +!:ext gal +# +# From: Joerg Jenderek +# URL: https://archive.org/details/iPhoto-Plus-4 +# https://filext.com/file-extension/TPL +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml +# Note: found in Template sub directory in program directory of software iPhoto Plus version 4 +# second, third and fourth directory entry name like TplHeader TplMainImage TplPreview +>>>>128 lestring16 TplHeader : Ulead iPhoto Template +#!:mime application/x-ole-storage +!:mime image/x-ulead-tpl +# https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template +!:ext tpl +# +# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) +# https://www.hancom.com/etc/hwpDownload.do +# Note: "HWP Document File" signature found in FileHeader +# Hangul Word Processor WORDIAN, 2002 and later is using HWP 5.0 format. +# Second directory entry name FileHeader hint for Thinkfree Office document +>>>>128 lestring16 FileHeader : Hancom HWP (Hangul Word Processor) file, version 5.0 +#!:mime application/haansofthwp +!:mime application/x-hwp +# https://example-files.online-convert.com/document/hwp/example.hwp +!:ext hwp +# +# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ +# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 +>>>>128 lestring16 dd2 : StarOffice Gallery view +#!:mime application/x-ole-storage +!:mime application/x-star-sdv +!:ext sdv +# URL: https://en.wikipedia.org/wiki/SoftMaker_Office +# second directory entry name Current User +>>>>128 lestring16 Current\ User : SoftMaker +# third directory entry name SMNativeObjData +>>>>>256 lestring16 SMNativeObjData +# 5th directory entry name PowerPoint +>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template +!:mime application/vnd.ms-powerpoint +!:ext ppt/pps/pot +# 4th directory entry name PowerPoint +>>>>>384 lestring16 PowerPoint Presentations or template +# http://extension.nirsoft.net/prv +!:mime application/vnd.softmaker.presentations +!:ext prd/prv +# third directory entry name like Current User +>>>>256 lestring16 Current\ User : SoftMaker +# 5th directory entry name PowerPoint +>>>>>512 lestring16 PowerPoint Presentations or template +# http://extension.nirsoft.net/prd +!:mime application/vnd.softmaker.presentations +!:ext prd/prv +# 2nd directory entry name Pictures +>>>>>>128 lestring16 Pictures with pictures +# +# URL: http://fileformats.archiveteam.org/wiki/PageMaker +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p +# pagemaker-generic.trid.xml +# pagemaker-pm6.trid.xml +# pagemaker-pm65.trid.xml +# pmd-pm7.trid.xml +# From: Joerg Jenderek +# Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors +# verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6` +# Second directory entry name PageMaker +>>>>128 lestring16 PageMaker : +# look for magic of "old" PageMaker like in 02TEMPLT.T65 +>>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99 +# GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version! +#>>>>>>&0 use PageMaker +# THIS WORKS PARTLY! +>>>>>>&0 indirect x +# remaining null clsid +>>>>128 default x +>>>>>0 use ole2-unknown +# look for CLSID where "second" part is 0 +>>>80 ubequad !0x0 +# +# Summary: Family Tree Maker +# From: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/Family_Tree_Maker +# https://en.wikipedia.org/wiki/Family_Tree_Maker +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftw.trid.xml +# Note called "Family Tree Maker Family Tree" by TrID and +# "FamilyTree Maker Database" with version "1-4" by DROID via PUID fmt/1352 +# tested only with version 2.0 +# verified by Michal Mutl Structured Storage Viewer `SSView.exe my.ftw` +# newer versions are SQLite based and handled by ./sql +# directory names like: IND.DB AUX.DB GENERAL.DB NAME.NDX BIRTH.NDX EXTRA.DB +>>>>80 ubequad 0x5702000000000000 : Family Tree Maker Windows database, version 1-4 +# look for "File Format (C) Copyright 1993 Banner Blue Software Inc. - All Rights Reserved" in GENERAL.DB +#>>>>>0 search/0x5460c/s F\0i\0l\0e\0\040\0F\0o\0r\0m\0a\0t\0\040\0(\0C\0)\0 \b, VERSION +# GRR: jump to version value like 2 does not work! +#>>>>>>&-8 ubyte x %u +#!:mime application/x-ole-storage +!:mime application/x-fmt +# FBK is used for backup of FTW +!:ext ftw/fbk +# +>>>>80 default x +>>>>>0 use ole2-unknown +# look for known clsid GUID +# - Visio documents +# URL: http://fileformats.archiveteam.org/wiki/Visio +# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek +>>88 ubequad 0xc000000000000046 +>>>80 ubequad 0x131a020000000000 : Microsoft Visio 2000-2002 Document, stencil or template +!:mime application/vnd.visio +# VSD~Drawing VSS~Stencil VST~Template +!:ext vsd/vss/vst +>>>80 ubequad 0x141a020000000000 : Microsoft Visio 2003-2010 Document, stencil or template +!:mime application/vnd.visio +!:ext vsd/vss/vst +# +# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer +# https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation +# Update: Joerg Jenderek +# Windows Installer Package *.MSI or validation module *.CUB +>>>80 ubequad 0x84100c0000000000 : Microsoft Windows Installer Package or validation module +!:mime application/x-msi +#!:mime application/x-ms-win-installer +# https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices +# cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub +#!:mime application/x-ms-cub +!:ext msi/cub +# From: Joerg Jenderek +# URL: http://en.wikipedia.org/wiki/Windows_Installer +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mst.trid.xml +# called "Windows SDK Setup Transform script" by TrID +>>>80 ubequad 0x82100c0000000000 : Microsoft Windows Installer transform script +#!:mime application/x-ole-storage +!:mime application/x-ms-mst +!:ext mst +>>>80 ubequad 0x86100c0000000000 : Microsoft Windows Installer Patch +# ?? +!:mime application/x-wine-extension-msp +#!:mime application/x-ms-msp +!:ext msp +# +# URL: http://fileformats.archiveteam.org/wiki/DOC +>>>80 ubequad 0x0009020000000000 : Microsoft Word 6-95 document or template +!:mime application/msword +# for template MSWDW8TN +!:apple MSWDWDBN +!:ext doc/dot +>>>80 ubequad 0x0609020000000000 : Microsoft Word 97-2003 document or template +!:mime application/msword +!:apple MSWDWDBN +# dot for template; no extension on Macintosh +!:ext doc/dot/ +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0x0213020000000000 : Microsoft Works 3-4 document or template +!:mime application/vnd.ms-works +!:apple ????AWWP +# ps for template https://filext.com/file-extension/PS bps for backup +!:ext wps/ps/bps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database +>>>80 ubequad 0x0313020000000000 : Microsoft Works 3-4 database or template +!:mime application/vnd.ms-works-db +# https://www.macdisk.com/macsigen.php +!:apple ????AWDB +# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup +!:ext wdb/db/bdb +# +# URL: https://en.wikipedia.org/wiki/Microsoft_Excel +>>>80 ubequad 0x1008020000000000 : Microsoft Excel 5-95 worksheet, addin or template +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php +!:apple ????XLS5 +# worksheet/addin/template/no extension on Macintosh +!:ext xls/xla/xlt/ +# +>>>80 ubequad 0x2008020000000000 : Microsoft Excel 97-2003 +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 +!:apple ????XLS9 +# 3rd directory entry name +>>>>256 lestring16 _VBA_PROJECT_CUR addin +!:ext xla/ +# 4th directory entry name +>>>>384 lestring16 _VBA_PROJECT_CUR addin +!:ext xla +#!:ext xla/ +>>>>256 default x worksheet or template +!:ext xls/xlt +#!:ext xls/xlt/ +# +# URL: http://fileformats.archiveteam.org/wiki/OLE2 +>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 item +#>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 Message +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-msg +!:ext msg +# URL: https://wiki.fileformat.com/email/oft/ +>>>80 ubequad 0x46f0060000000000 : Microsoft Outlook 97-2003 item template +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-oft +!:ext oft +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +>>>80 ubequad 0x5148040000000000 : Microsoft PowerPoint 4.0 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt +# Summary: "newer" Greenstreet Art drawing +# From: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/GST_ART +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml +# Note: called like "Greenstreet Art drawing" by TrID +# Note: CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16 +# verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART` +>>>80 ubequad 0x602c020000000000 : Greenstreet Art drawing +#!:mime application/x-ole-storage +!:mime image/x-greenstreet-art +!:ext art +>>>80 default x +>>>>0 use ole2-unknown +#?? +# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ +>>88 ubequad 0xa29a00aa004a1a72 : Microsoft +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database +>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database +!:mime application/vnd.ms-works-db +!:apple ????AWDB +!:ext wdb/bdb +#?? +>>88 ubequad 0xa40700c04fb932ba : Microsoft +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +# From: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Microsoft_Works +# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +# Note: probably version 6 and 7 +# organize pictures like JPFG images in streams __cf1 with names like +# 001.JPG, 002.JPG ... in streams __fname +>>88 ubequad 0xa1c800c04f612452 : Microsoft +>>>80 ubequad 0xc0c7266eb98cd311 Works portfolio +# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed +#!:mime application/x-ole-storage +# https://www.iana.org/assignments/media-types/application/vnd.ms-works +!:mime application/vnd.ms-works +# https://extension.nirsoft.net/wsb +# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb +!:ext wsb +#?? +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher +>>88 ubequad 0x00c0000000000046 : Microsoft +>>>80 ubequad 0x0112020000000000 Publisher +!:mime application/vnd.ms-publisher +!:ext pub +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +#?? +>>88 ubequad 0xa90300aa00510ea3 : Microsoft +>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt/pot +#?? +>>88 ubequad 0x86ea00aa00b929e8 : Microsoft +>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template +!:mime application/vnd.ms-powerpoint +!:apple ????PPT3 +# /autostart/template +!:ext ppt/pps/pot +# From: Joerg Jenderek +# URL: https://www.file-extensions.org/ppa-file-extension +# https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231 +# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +>>88 ubequad 0x871800aa0060263b : Microsoft +# only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org) +>>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard +# second, third and fourth directory entry name like VBA PROJECT PROJECTwm +# http://extension.nirsoft.net/pwz +!:mime application/vnd.ms-powerpoint +# like: BSHPPT97.PPA "AutoContent Wizard.pwz" +!:ext ppa/pwz +# +# From: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document) +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml +# Note: called "Microsoft At Work Fax document" by TrID +>>88 ubequad 0xb29400dd010f2bf9 : Microsoft +>>>80 ubequad 0x801cb0023de01a10 At Work fax Document +#!:mime application/x-ole-storage +!:mime image/x-ms-awd +!:ext awd +# +# URL: https://en.wikipedia.org/wiki/Microsoft_Project +#?? +>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft +>>>80 ubequad 0x3a8fb774c8c8d111 Project +!:mime application/vnd.ms-project +!:ext mpp +# From: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml +# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +# Note: only version 8 tested and called "Office Binder Document" by TrID and +# "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240 +>>88 ubequad 0xb21c00aa004ba90b : Microsoft +>>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard +# second directory entry name like Binder +# https://www.file-extensions.org/obd-file-extension +#!:mime application/vnd.ms-binder +!:mime application/x-msbinder +# obt for template; obz for Microsoft Office Binder wizard +!:ext obd/obt/obz +# +# URL: http://fileformats.archiveteam.org/wiki/WordPerfect +# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +# https://github.com/OneWingedShark/WordPerfect/ +# blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm +# From: Joerg Jenderek +# Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd +# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN, +# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors +>>88 ubequad 0x19370000929679cd : WordPerfect 7 +>>>80 ubequad 0xff739851ad2d2002 Document +!:mime application/vnd.wordperfect +#!:apple ????WPC? +# https://fossies.org/linux/wp2latex/test/ole6.wpd +!:ext wpd +#>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE +# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end +#>>>>>&0 indirect x \b; contains +# GRR: the above expression does not work correctly +# +# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) +#??? +>>88 ubequad 0x99ae04021c007002 : WordPerfect +>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation +!:mime application/x-corelpresentations +#!:mime application/x-shw-viewer +#!:mime image/x-presentations +!:ext shw +# +# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ +>>>80 ubequad 0x60fe2e4099191b10 9 Graphic +#!:mime application/x-wpg +#!:mime image/x-wordperfect-graphics +!:mime image/x-wpg +# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd +!:apple ????WPC9 +!:ext wpg +# +# From: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/CorelCAD +# https://en.wikipedia.org/wiki/CorelCAD +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccd-corelcad.trid.xml +# Note: called "CorelCAD Drawing" by TrID and CorelCAD +# directory entry names like Contents ViewInfo CustomViewDescriptions LayerInfo +>>88 ubequad 0xbe26db67235e2689 : Corel +>>>80 ubequad 0x20f414de1cacce11 \bCAD Drawing or Template +#!:mime application/x-ole-storage +!:mime application/x-corel-cad +# CCT for CorelCAD Template +!:ext ccd/cct +# +# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats +>>88 ubequad 0x996104021c007002 : StarOffice +>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template +# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html +!:mime application/x-starwriter +!:ext sdw/vor +# +>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template +!:mime application/x-starcalc +!:ext sdc/vor +# +>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template +!:mime application/x-starimpress +#!:mime application/x-stardraw +# sda ?? +!:ext sdd/sda/vor +#?? +>>88 ubequad 0x89cb008029e4b0b1 : StarOffice +>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template +!:mime application/x-starcalc +!:ext sdc/vor +# +>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template +!:mime application/vnd.stardivision.cal +!:ext sdc/vor +# +>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template +!:mime application/x-starimpress +!:ext sdd/vor +#?? +>>88 ubequad 0xb12a04021c007002 : StarOffice +>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 +!:mime application/x-starmath +!:ext smf +#?? +>>88 ubequad 0x8e2c00001b4cc711 : StarOffice +>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 +!:mime application/x-starchart +!:ext sds +#?? +>>88 ubequad 0xa45e00a0249d57b1 : StarOffice +>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template +!:mime application/x-starwriter +!:ext sdw/vor +#?? +>>88 ubequad 0x89ca008029e4b0b1 : StarOffice +>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 +!:mime application/x-starmath +!:ext smf +# +>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 +!:mime application/x-starchart +!:ext sds +#?? +>>88 ubequad 0xa53f00a0249d57b1 : StarOffice +>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document +!:mime application/x-starwriter-global +!:ext sgl +#?? +>>88 ubequad 0x89d0008029e4b0b1 : StarOffice +>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 +!:mime application/vnd.stardivision.math +!:ext smf +# +>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template +!:mime application/vnd.stardivision.draw +!:ext sda/vor +# +>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template +!:mime application/vnd.stardivision.impress +# sda is used for what? +!:ext sdd/vor/sda +# +>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 +!:mime application/vnd.stardivision.chart +!:ext sds +# ?? +>>88 ubequad 0xaab4006097da561a : StarOffice +>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template +!:mime application/vnd.stardivision.writer +!:ext sdw/vor +# +>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document +!:mime application/vnd.stardivision.writer-global +!:ext sgl +#?? +# URL: http://fileformats.archiveteam.org/wiki/FlashPix +>>88 ubequad 0x855300aa00a1f95b : Kodak +>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image +!:mime image/vnd.fpx +!:apple ????FPix +!:ext fpx +# URL: https://en.wikipedia.org/wiki/SoftMaker_Office +>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker +>>>80 ubequad 0x9174088a6452d411 document or template +!:mime application/vnd.softmaker.planmaker +# pmv for template https://www.file-extensions.org/pmv-file-extension +!:ext pmd/pmv +# URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max) +# https://en.wikipedia.org/wiki/Autodesk_3ds_Max +# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File +# Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and +# "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max` +# applies only to "newer" versions (about 2008-2020) +>>88 ubequad 0x9fed04143144cc1e : Autodesk +>>>80 ubequad 0x7b8cdd1cc081a045 3ds Max +#!:mime application/x-ole-storage +!:mime model/x-autodesk-max +# like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max +!:ext max +# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978 +#!:ext max/chr +# remaining non null clsid +>>88 default x +>>>0 use ole2-unknown +# display information about directory for not detected CDF files +0 name ole2-unknown +>80 ubequad x : UNKNOWN +# https://reposcope.com/mimetype/application/x-ole-storage +!:mime application/x-ole-storage +# according to file version 5.41 with -e soft option +#!:mime application/CDFV2 +#!:ext ??? +>80 ubequad !0 \b, clsid %#16.16llx +>>88 ubequad x \b%16.16llx +# converted hexadecimal format to standard GUUID notation +>>80 guid x {%s} +# second directory entry name like VisioDocument Control000 +>128 lestring16 x with names %.20s +# third directory entry like WordDocument Preview.dib +>256 lestring16 x %.20s +# forth like \005SummaryInformation +>384 lestring16 x %.25s +# 5th +>512 lestring16 x %.10s +# 6th +>640 lestring16 x %.10s +# 7th +>768 lestring16 x %.10s |