Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var SIG_1PASSWORD_4_CLOUD_KEYCHAIN_ATTACHMENT = FileSignature{ Description: "1Password 4 Cloud Keychain", Header: []byte{0x4f, 0x50, 0x43, 0x4c, 0x44, 0x41, 0x54}, Extensions: []string{"ATTACHMENT"}, Class: "Encryption", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_1PASSWORD_4_CLOUD_KEYCHAIN_ENCRYPTED_DATA = FileSignature{ Description: "1Password 4 Cloud Keychain encrypted data", Header: []byte{0x6f, 0x70, 0x64, 0x61, 0x74, 0x61, 0x30, 0x31}, Extensions: []string(nil), Class: "Encryption", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_3GPP2_MULTIMEDIA_FILES_3GP = FileSignature{ Description: "3GPP2 multimedia files", Header: []byte{0x0, 0x0, 0x0, 0x20, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"3GP"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_3GPP_MULTIMEDIA_FILES_3GP = FileSignature{ Description: "3GPP multimedia files", Header: []byte{0x0, 0x0, 0x0, 0x14, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"3GP"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_3RD_GENERATION_PARTNERSHIP_PROJECT_3GPP2_3GG_3GP_3G2 = FileSignature{ Description: "3rd Generation Partnership Project 3GPP2", Header: []byte{0x0, 0x0, 0x0, 0x20, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"3GG", "3GP", "3G2"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_3RD_GENERATION_PARTNERSHIP_PROJECT_3GPP_3GG_3GP_3G2 = FileSignature{ Description: "3rd Generation Partnership Project 3GPP", Header: []byte{0x0, 0x0, 0x0, 0x14, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"3GG", "3GP", "3G2"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_4X_MOVIE_VIDEO_4XM = FileSignature{ Description: "4X Movie video", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"4XM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_7_ZIP_COMPRESSED_FILE_7Z = FileSignature{ Description: "7-Zip compressed file", Header: []byte{0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c}, Extensions: []string{"7Z"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACCESS_DATA_FTK_EVIDENCE_DAT = FileSignature{ Description: "Access Data FTK evidence", Header: []byte{0xa9, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACCESS_PROJECT_FILE_ADP = FileSignature{ Description: "Access project file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"ADP"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACROBAT_PLUG_IN_API = FileSignature{ Description: "Acrobat plug-in", Header: []byte{0x4d, 0x5a, 0x90, 0x0, 0x3, 0x0, 0x0, 0x0}, Extensions: []string{"API"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACRONIS_TRUE_IMAGE_1_TIB = FileSignature{ Description: "Acronis True Image_1", Header: []byte{0xb4, 0x6e, 0x68, 0x44}, Extensions: []string{"TIB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACRONIS_TRUE_IMAGE_2_TIB = FileSignature{ Description: "Acronis True Image_2", Header: []byte{0xce, 0x24, 0xb9, 0xa2, 0x20, 0x0, 0x0, 0x0}, Extensions: []string{"TIB"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ACTIVEX_OLE_CUSTOM_CONTROL_OCX = FileSignature{ Description: "ActiveX-OLE Custom Control", Header: []byte{0x4d, 0x5a}, Extensions: []string{"OCX"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ADAPTIVE_MULTI_RATE_ACELP_CODEC_GSM_AMR = FileSignature{ Description: "Adaptive Multi-Rate ACELP Codec (GSM)", Header: []byte{0x23, 0x21, 0x41, 0x4d, 0x52}, Extensions: []string{"AMR"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ADOBE_ENCAPSULATED_POSTSCRIPT_EPS = FileSignature{ Description: "Adobe encapsulated PostScript", Header: []byte{0xc5, 0xd0, 0xd3, 0xc6}, Extensions: []string{"EPS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ADOBE_FRAMEMAKER_FM_MIF = FileSignature{ Description: "Adobe FrameMaker", Header: []byte{0x3c, 0x4d, 0x61, 0x6b, 0x65, 0x72, 0x46, 0x69}, Extensions: []string{"FM", "MIF"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ADOBE_INDESIGN_INDD = FileSignature{ Description: "Adobe InDesign", Header: []byte{0x6, 0x6, 0xed, 0xf5, 0xd8, 0x1d, 0x46, 0xe5, 0xbd, 0x31, 0xef, 0xe7, 0xfe, 0x74, 0xb7, 0x1d}, Extensions: []string{"INDD"}, Class: "Media", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ADVANCED_STREAM_REDIRECTOR_ASX = FileSignature{ Description: "Advanced Stream Redirector", Header: []byte{0x3c}, Extensions: []string{"ASX"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AGENT_NEWSREADER_CHARACTER_MAP_COD = FileSignature{ Description: "Agent newsreader character map", Header: []byte{0x4e, 0x61, 0x6d, 0x65, 0x3a, 0x20}, Extensions: []string{"COD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AIN_COMPRESSED_ARCHIVE_AIN = FileSignature{ Description: "AIN Compressed Archive", Header: []byte{0x21, 0x12}, Extensions: []string{"AIN"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ALLEGRO_GENERIC_PACKFILE_COMPRESSED_DAT = FileSignature{ Description: "Allegro Generic Packfile (compressed)", Header: []byte{0x73, 0x6c, 0x68, 0x21}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ALLEGRO_GENERIC_PACKFILE_UNCOMPRESSED_DAT = FileSignature{ Description: "Allegro Generic Packfile (uncompressed)", Header: []byte{0x73, 0x6c, 0x68, 0x2e}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AMIGA_DISKMASHER_COMPRESSED_ARCHIVE_DMS = FileSignature{ Description: "Amiga DiskMasher compressed archive", Header: []byte{0x44, 0x4d, 0x53, 0x21}, Extensions: []string{"DMS"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AMIGA_DISK_FILE_ADF = FileSignature{ Description: "Amiga disk file", Header: []byte{0x44, 0x4f, 0x53}, Extensions: []string{"ADF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AMIGA_HUNK_EXECUTABLE = FileSignature{ Description: "Amiga Hunk executable", Header: []byte{0x0, 0x0, 0x3, 0xf3}, Extensions: []string(nil), Class: "System", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AMIGA_ICON_INFO = FileSignature{ Description: "Amiga icon", Header: []byte{0xe3, 0x10, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"INFO"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ANDROID_PACKAGE_APK = FileSignature{ Description: "Android package", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"APK"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ANTENNA_DATA_FILE_AD = FileSignature{ Description: "Antenna data file", Header: []byte{0x52, 0x45, 0x56, 0x4e, 0x55, 0x4d, 0x3a, 0x2c}, Extensions: []string{"AD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_ADDRESS_BOOK_ABY = FileSignature{ Description: "AOL address book", Header: []byte{0x41, 0x4f, 0x4c, 0x44, 0x42}, Extensions: []string{"ABY"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_ADDRESS_BOOK_INDEX_ABI = FileSignature{ Description: "AOL address book index", Header: []byte{0x41, 0x4f, 0x4c, 0x49, 0x4e, 0x44, 0x45, 0x58}, Extensions: []string{"ABI"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_AND_AIM_BUDDY_LIST_BAG = FileSignature{ Description: "AOL and AIM buddy list", Header: []byte{0x41, 0x4f, 0x4c, 0x20, 0x46, 0x65, 0x65, 0x64}, Extensions: []string{"BAG"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_ART_FILE_1_JG = FileSignature{ Description: "AOL ART file_1", Header: []byte{0x4a, 0x47, 0x3, 0xe}, Extensions: []string{"JG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0xd0, 0xcb, 0x0, 0x0}, }
View Source
var SIG_AOL_ART_FILE_2_JG = FileSignature{ Description: "AOL ART file_2", Header: []byte{0x4a, 0x47, 0x4, 0xe}, Extensions: []string{"JG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0xcf, 0xc7, 0xcb}, }
View Source
var SIG_AOL_CLIENT_PREFERENCES_SETTINGS_FILE_IND = FileSignature{ Description: "AOL client preferences-settings file", Header: []byte{0x41, 0x4f, 0x4c, 0x49, 0x44, 0x58}, Extensions: []string{"IND"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_CONFIG_FILES_ABI_ABY_BAG_IDX_IND_PFC = FileSignature{ Description: "AOL config files", Header: []byte{0x41, 0x4f, 0x4c}, Extensions: []string{"ABI", "ABY", "BAG", "IDX", "IND", "PFC"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_HISTORY_TYPED_URL_FILES_ARL_AUT = FileSignature{ Description: "AOL history|typed URL files", Header: []byte{0xd4, 0x2a}, Extensions: []string{"ARL", "AUT"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_HTML_MAIL_DCI = FileSignature{ Description: "AOL HTML mail", Header: []byte{0x3c, 0x21, 0x64, 0x6f, 0x63, 0x74, 0x79, 0x70}, Extensions: []string{"DCI"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_PARAMETER_INFO_FILES = FileSignature{ Description: "AOL parameter-info files", Header: []byte{0x41, 0x43, 0x53, 0x44}, Extensions: []string(nil), Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_PERSONAL_FILE_CABINET_ORG_PFC = FileSignature{ Description: "AOL personal file cabinet", Header: []byte{0x41, 0x4f, 0x4c, 0x56, 0x4d, 0x31, 0x30, 0x30}, Extensions: []string{"ORG", "PFC"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AOL_USER_CONFIGURATION_IDX = FileSignature{ Description: "AOL user configuration", Header: []byte{0x41, 0x4f, 0x4c, 0x44, 0x42}, Extensions: []string{"IDX"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_APPLE_AUDIO_AND_VIDEO_M4A = FileSignature{ Description: "Apple audio and video", Header: []byte{0x0, 0x0, 0x0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x4d, 0x34, 0x41}, Extensions: []string{"M4A"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_APPLE_CORE_AUDIO_FILE_CAF = FileSignature{ Description: "Apple Core Audio File", Header: []byte{0x63, 0x61, 0x66, 0x66}, Extensions: []string{"CAF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_APPLE_ISO_9660_HFS_HYBRID_CD_IMAGE_ISO = FileSignature{ Description: "Apple ISO 9660-HFS hybrid CD image", Header: []byte{0x45, 0x52, 0x2, 0x0, 0x0}, Extensions: []string{"ISO"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_APPLE_LOSSLESS_AUDIO_CODEC_FILE_M4A = FileSignature{ Description: "Apple Lossless Audio Codec file", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x4d, 0x34, 0x41, 0x20}, Extensions: []string{"M4A"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_APPROACH_INDEX_FILE_ADX = FileSignature{ Description: "Approach index file", Header: []byte{0x3, 0x0, 0x0, 0x0, 0x41, 0x50, 0x50, 0x52}, Extensions: []string{"ADX"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ARCMAP_GIS_PROJECT_FILE_MXD = FileSignature{ Description: "ArcMap GIS project file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"MXD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AUDACITY_AUDIO_FILE_AU = FileSignature{ Description: "Audacity audio file", Header: []byte{0x64, 0x6e, 0x73, 0x2e}, Extensions: []string{"AU"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AUDIO_INTERCHANGE_FILE_AIFF = FileSignature{ Description: "Audio Interchange File", Header: []byte{0x46, 0x4f, 0x52, 0x4d, 0x0}, Extensions: []string{"AIFF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AUDITION_GRAPHIC_FILTER_FLT = FileSignature{ Description: "Audition graphic filter", Header: []byte{0x4d, 0x5a, 0x90, 0x0, 0x3, 0x0, 0x0, 0x0}, Extensions: []string{"FLT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_AVG6_INTEGRITY_DATABASE_DAT = FileSignature{ Description: "AVG6 Integrity database", Header: []byte{0x41, 0x56, 0x47, 0x36, 0x5f, 0x49, 0x6e, 0x74}, Extensions: []string{"DAT"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BASE85_FILE_B85 = FileSignature{ Description: "BASE85 file", Header: []byte{0x3c, 0x7e, 0x36, 0x3c, 0x5c, 0x25, 0x5f, 0x30, 0x67, 0x53, 0x71, 0x68, 0x3b}, Extensions: []string{"B85"}, Class: "Word processing", HeaderOffset: 0, Trailer: []byte{0x7e, 0x3e, 0xa}, }
View Source
var SIG_BETTER_PORTABLE_GRAPHICS_BPG = FileSignature{ Description: "Better Portable Graphics", Header: []byte{0x42, 0x50, 0x47, 0xfb}, Extensions: []string{"BPG"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BGBLITZ_POSITION_DATABASE_FILE_PDB = FileSignature{ Description: "BGBlitz position database file", Header: []byte{0xac, 0xed, 0x0, 0x5, 0x73, 0x72, 0x0, 0x12}, Extensions: []string{"PDB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BINARY_PROPERTY_LIST_PLIST = FileSignature{ Description: "Binary property list (plist)", Header: []byte{0x62, 0x70, 0x6c, 0x69, 0x73, 0x74}, Extensions: []string(nil), Class: "System", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BINHEX_4_COMPRESSED_ARCHIVE_HQX = FileSignature{ Description: "BinHex 4 Compressed Archive", Header: []byte{0x28, 0x54, 0x68, 0x69, 0x73, 0x20, 0x66, 0x69}, Extensions: []string{"HQX"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BIOS_DETAILS_IN_RAM = FileSignature{ Description: "BIOS details in RAM", Header: []byte{0x0, 0x14, 0x0, 0x0, 0x1, 0x2}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BITCOIN_CORE_WALLETDAT_FILE_DAT = FileSignature{ Description: "Bitcoin Core wallet.dat file", Header: []byte{0x0, 0x0, 0x0, 0x0, 0x62, 0x31, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"DAT"}, Class: "Finance", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_BITCOIN_QT_BLOCKCHAIN_BLOCK_FILE_DAT = FileSignature{ Description: "Bitcoin-Qt blockchain block file", Header: []byte{0xf9, 0xbe, 0xb4, 0xd9}, Extensions: []string{"DAT"}, Class: "E-money", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BITLOCKER_BOOT_SECTOR_VISTA = FileSignature{ Description: "BitLocker boot sector (Vista)", Header: []byte{0xeb, 0x52, 0x90, 0x2d, 0x46, 0x56, 0x45, 0x2d}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BITLOCKER_BOOT_SECTOR_WIN7 = FileSignature{ Description: "BitLocker boot sector (Win7)", Header: []byte{0xeb, 0x58, 0x90, 0x2d, 0x46, 0x56, 0x45, 0x2d}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BITMAP_IMAGE_BMP_DIB = FileSignature{ Description: "Bitmap image", Header: []byte{0x42, 0x4d}, Extensions: []string{"BMP", "DIB"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BIZTALK_XML_DATA_REDUCED_SCHEMA_XDR = FileSignature{ Description: "BizTalk XML-Data Reduced Schema", Header: []byte{0x3c}, Extensions: []string{"XDR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BLINK_COMPRESSED_ARCHIVE_BLI = FileSignature{ Description: "Blink compressed archive", Header: []byte{0x42, 0x6c, 0x69, 0x6e, 0x6b}, Extensions: []string{"BLI"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BROTHER_BABYLOCK_BERNINA_HOME_EMBROIDERY_PEC = FileSignature{ Description: "Brother-Babylock-Bernina Home Embroidery", Header: []byte{0x23, 0x50, 0x45, 0x43, 0x30, 0x30, 0x30, 0x31}, Extensions: []string{"PEC"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BROTHER_BABYLOCK_BERNINA_HOME_EMBROIDERY_PES = FileSignature{ Description: "Brother-Babylock-Bernina Home Embroidery", Header: []byte{0x23, 0x50, 0x45, 0x53, 0x30}, Extensions: []string{"PES"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_BZIP2_COMPRESSED_ARCHIVE_BZ2_TAR_BZ2_TBZ2_TB2 = FileSignature{ Description: "bzip2 compressed archive", Header: []byte{0x42, 0x5a, 0x68}, Extensions: []string{"BZ2", "TAR", "BZ2", "TBZ2", "TB2"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CALCULUX_INDOOR_LIGHTING_PROJECT_FILE_CIN = FileSignature{ Description: "Calculux Indoor lighting project file", Header: []byte{0x43, 0x61, 0x6c, 0x63, 0x75, 0x6c, 0x75, 0x78, 0x20, 0x49, 0x6e, 0x64, 0x6f, 0x6f, 0x72, 0x20}, Extensions: []string{"CIN"}, Class: "Application", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CALS_RASTER_BITMAP_CAL = FileSignature{ Description: "CALS raster bitmap", Header: []byte{0x73, 0x72, 0x63, 0x64, 0x6f, 0x63, 0x69, 0x64}, Extensions: []string{"CAL"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CANON_RAW_FILE_CRW = FileSignature{ Description: "Canon RAW file", Header: []byte{0x49, 0x49, 0x1a, 0x0, 0x0, 0x0, 0x48, 0x45}, Extensions: []string{"CRW"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CASEWARE_WORKING_PAPERS_AC_ = FileSignature{ Description: "CaseWare Working Papers", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"AC_"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CD_STOMPER_PRO_LABEL_FILE_DSN = FileSignature{ Description: "CD Stomper Pro label file", Header: []byte{0x4d, 0x56}, Extensions: []string{"DSN"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CERIUS2_FILE_MSI = FileSignature{ Description: "Cerius2 file", Header: []byte{0x23, 0x20}, Extensions: []string{"MSI"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CHROMAGRAPH_GRAPHICS_CARD_BITMAP_IMG = FileSignature{ Description: "ChromaGraph Graphics Card Bitmap", Header: []byte{0x50, 0x49, 0x43, 0x54, 0x0, 0x8}, Extensions: []string{"IMG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_ARCHIVE_FILE_ARJ = FileSignature{ Description: "Compressed archive file", Header: []byte{0x60, 0xea}, Extensions: []string{"ARJ"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_ARCHIVE_FILE_PAK = FileSignature{ Description: "Compressed archive file", Header: []byte{0x1a, 0xb}, Extensions: []string{"PAK"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_ARCHIVE_LHA_LZH = FileSignature{ Description: "Compressed archive", Header: []byte{0x2d, 0x6c, 0x68}, Extensions: []string{"LHA", "LZH"}, Class: "Compressed archive", HeaderOffset: 2, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_ISO_CD_IMAGE_CSO = FileSignature{ Description: "Compressed ISO CD image", Header: []byte{0x43, 0x49, 0x53, 0x4f}, Extensions: []string{"CSO"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_TAPE_ARCHIVE_1_TARZ = FileSignature{ Description: "Compressed tape archive_1", Header: []byte{0x1f, 0x9d, 0x90}, Extensions: []string{"TAR.Z"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPRESSED_TAPE_ARCHIVE_2_TARZ = FileSignature{ Description: "Compressed tape archive_2", Header: []byte{0x1f, 0xa0}, Extensions: []string{"TAR.Z"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMPUCON_SINGER_EMBROIDERY_DESIGN_FILE_XXX = FileSignature{ Description: "Compucon-Singer embroidery design file", Header: []byte{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"XXX"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COMP_CATALOG_CLB = FileSignature{ Description: "COM+ Catalog", Header: []byte{0x43, 0x4f, 0x4d, 0x2b}, Extensions: []string{"CLB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CONTROL_PANEL_APPLICATION_CPL = FileSignature{ Description: "Control panel application", Header: []byte{0x4d, 0x5a}, Extensions: []string{"CPL"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CORELDRAW_DOCUMENT_CDR = FileSignature{ Description: "CorelDraw document", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"CDR"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_BINARY_METAFILE_CLB = FileSignature{ Description: "Corel Binary metafile", Header: []byte{0x43, 0x4d, 0x58, 0x31}, Extensions: []string{"CLB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_COLOR_PALETTE_CPL = FileSignature{ Description: "Corel color palette", Header: []byte{0xdc, 0xdc}, Extensions: []string{"CPL"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_PAINT_SHOP_PRO_IMAGE_PSP = FileSignature{ Description: "Corel Paint Shop Pro image", Header: []byte{0x7e, 0x42, 0x4b, 0x0}, Extensions: []string{"PSP"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_PHOTOPAINT_FILE_1_CPT = FileSignature{ Description: "Corel Photopaint file_1", Header: []byte{0x43, 0x50, 0x54, 0x37, 0x46, 0x49, 0x4c, 0x45}, Extensions: []string{"CPT"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_PHOTOPAINT_FILE_2_CPT = FileSignature{ Description: "Corel Photopaint file_2", Header: []byte{0x43, 0x50, 0x54, 0x46, 0x49, 0x4c, 0x45}, Extensions: []string{"CPT"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_COREL_PRESENTATION_EXCHANGE_METADATA_CMX = FileSignature{ Description: "Corel Presentation Exchange metadata", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"CMX"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CPIO_ARCHIVE = FileSignature{ Description: "cpio archive", Header: []byte{0x30, 0x37, 0x30, 0x37, 0x30}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CREATIVE_VOICE_VOC = FileSignature{ Description: "Creative Voice", Header: []byte{0x43, 0x72, 0x65, 0x61, 0x74, 0x69, 0x76, 0x65, 0x20, 0x56, 0x6f, 0x69, 0x63, 0x65, 0x20, 0x46}, Extensions: []string{"VOC"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CRUSH_COMPRESSED_ARCHIVE_CRU = FileSignature{ Description: "Crush compressed archive", Header: []byte{0x43, 0x52, 0x55, 0x53, 0x48, 0x20, 0x76}, Extensions: []string{"CRU"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_CSOUND_MUSIC_CSD = FileSignature{ Description: "Csound music", Header: []byte{0x3c, 0x43, 0x73, 0x6f, 0x75, 0x6e, 0x64, 0x53, 0x79, 0x6e, 0x74, 0x68, 0x65, 0x73, 0x69, 0x7a}, Extensions: []string{"CSD"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DAKX_COMPRESSED_AUDIO_DAX = FileSignature{ Description: "DAKX Compressed Audio", Header: []byte{0x46, 0x4f, 0x52, 0x4d, 0x0}, Extensions: []string{"DAX"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DALVIK_ANDROID_EXECUTABLE_FILE_DEX = FileSignature{ Description: "Dalvik (Android) executable file", Header: []byte{0x64, 0x65, 0x78, 0xa}, Extensions: []string{"DEX"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DAX_COMPRESSED_CD_IMAGE_DAX = FileSignature{ Description: "DAX Compressed CD image", Header: []byte{0x44, 0x41, 0x58, 0x0}, Extensions: []string{"DAX"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DB2_CONVERSION_FILE_CNV = FileSignature{ Description: "DB2 conversion file", Header: []byte{0x53, 0x51, 0x4c, 0x4f, 0x43, 0x4f, 0x4e, 0x56}, Extensions: []string{"CNV"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DBASE_III_FILE_DB3 = FileSignature{ Description: "dBASE III file", Header: []byte{0x3}, Extensions: []string{"DB3"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DBASE_IV_FILE_DB4 = FileSignature{ Description: "dBASE IV file", Header: []byte{0x4}, Extensions: []string{"DB4"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DBASE_IV_OR_DBFAST_CONFIGURATION_FILE_DB = FileSignature{ Description: "dBASE IV or dBFast configuration file", Header: []byte{0x8}, Extensions: []string{"DB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DELUXEPAINT_ANIMATION_ANM = FileSignature{ Description: "DeluxePaint Animation", Header: []byte{0x4c, 0x50, 0x46, 0x20, 0x0, 0x1}, Extensions: []string{"ANM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DESIGNTOOLS_2D_DESIGN_FILE_DTD = FileSignature{ Description: "DesignTools 2D Design file", Header: []byte{0x7, 0x64, 0x74, 0x32, 0x64, 0x64, 0x74, 0x64}, Extensions: []string{"DTD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DESKMATE_DOCUMENT_DOC = FileSignature{ Description: "DeskMate Document", Header: []byte{0xd, 0x44, 0x4f, 0x43}, Extensions: []string{"DOC"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DESKMATE_WORKSHEET_WKS = FileSignature{ Description: "DeskMate Worksheet", Header: []byte{0xe, 0x57, 0x4b, 0x53}, Extensions: []string{"WKS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DEVELOPER_STUDIO_FILE_OPTIONS_FILE_OPT = FileSignature{ Description: "Developer Studio File Options file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"OPT"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DEVELOPER_STUDIO_SUBHEADER_OPT = FileSignature{ Description: "Developer Studio subheader", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x20}, Extensions: []string{"OPT"}, Class: "Programming", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_DIAL_UP_NETWORKING_FILE_DUN = FileSignature{ Description: "Dial-up networking file", Header: []byte{0x5b, 0x50, 0x68, 0x6f, 0x6e, 0x65, 0x5d}, Extensions: []string{"DUN"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DIGITAL_SPEECH_STANDARD_FILE_DSS = FileSignature{ Description: "Digital Speech Standard file", Header: []byte{0x2, 0x64, 0x73, 0x73}, Extensions: []string{"DSS"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DIGITAL_WATCHDOG_DW_TP_500G_AUDIO_IMG = FileSignature{ Description: "Digital Watchdog DW-TP-500G audio", Header: []byte{0x7e, 0x74, 0x2c, 0x1, 0x50, 0x70, 0x2, 0x4d, 0x52}, Extensions: []string{"IMG"}, Class: "Audio", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DIRECTSHOW_FILTER_AX = FileSignature{ Description: "DirectShow filter", Header: []byte{0x4d, 0x5a, 0x90, 0x0, 0x3, 0x0, 0x0, 0x0}, Extensions: []string{"AX"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DOS_SYSTEM_DRIVER_SYS = FileSignature{ Description: "DOS system driver", Header: []byte{0xff, 0xff, 0xff, 0xff}, Extensions: []string{"SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DREAMCAST_AUDIO_ADX = FileSignature{ Description: "Dreamcast audio", Header: []byte{0x80, 0x0, 0x0, 0x20, 0x3, 0x12, 0x4}, Extensions: []string{"ADX"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DREAMCAST_SOUND_FORMAT_DSF = FileSignature{ Description: "Dreamcast Sound Format", Header: []byte{0x50, 0x53, 0x46, 0x12}, Extensions: []string{"DSF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DSD_STORAGE_FACILITY_AUDIO_FILE_DSF = FileSignature{ Description: "DSD Storage Facility audio file", Header: []byte{0x44, 0x53, 0x44, 0x20}, Extensions: []string{"DSF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DST_COMPRESSION_DST = FileSignature{ Description: "DST Compression", Header: []byte{0x44, 0x53, 0x54, 0x62}, Extensions: []string{"DST"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DVD_INFO_FILE_IFO = FileSignature{ Description: "DVD info file", Header: []byte{0x44, 0x56, 0x44}, Extensions: []string{"IFO"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_DVD_VIDEO_FILE_MPG_VOB = FileSignature{ Description: "DVD video file", Header: []byte{0x0, 0x0, 0x1, 0xba}, Extensions: []string{"MPG", "VOB"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte{0x0, 0x0, 0x1, 0xb9}, }
View Source
var SIG_DVR_STUDIO_STREAM_FILE_DVR = FileSignature{ Description: "DVR-Studio stream file", Header: []byte{0x44, 0x56, 0x44}, Extensions: []string{"DVR"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EASYRECOVERY_SAVED_STATE_FILE_DAT = FileSignature{ Description: "EasyRecovery Saved State file", Header: []byte{0x45, 0x52, 0x46, 0x53, 0x53, 0x41, 0x56, 0x45}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EASY_CD_CREATOR_5_LAYOUT_FILE_CL5 = FileSignature{ Description: "Easy CD Creator 5 Layout file", Header: []byte{0x10, 0x0, 0x0, 0x0}, Extensions: []string{"CL5"}, Class: "Utility", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EASY_STREET_DRAW_DIAGRAM_FILE_ESD = FileSignature{ Description: "Easy Street Draw diagram file", Header: []byte{0x7e, 0x45, 0x53, 0x44, 0x77, 0xf6, 0x85, 0x3e, 0xbf, 0x6a, 0xd2, 0x11, 0x45, 0x61, 0x73, 0x79, 0x20, 0x53, 0x74, 0x72, 0x65, 0x65, 0x74, 0x20, 0x44, 0x72, 0x61, 0x77}, Extensions: []string{"ESD"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EA_INTERCHANGE_FORMAT_FILE_IFF_1_IFF = FileSignature{ Description: "EA Interchange Format File (IFF)_1", Header: []byte{0x46, 0x4f, 0x52, 0x4d}, Extensions: []string{"IFF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EA_INTERCHANGE_FORMAT_FILE_IFF_2_IFF = FileSignature{ Description: "EA Interchange Format File (IFF)_2", Header: []byte{0x4c, 0x49, 0x53, 0x54}, Extensions: []string{"IFF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EA_INTERCHANGE_FORMAT_FILE_IFF_3_IFF = FileSignature{ Description: "EA Interchange Format File (IFF)_3", Header: []byte{0x43, 0x41, 0x54, 0x20}, Extensions: []string{"IFF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EFAX_FILE_EFX = FileSignature{ Description: "eFax file", Header: []byte{0xdc, 0xfe}, Extensions: []string{"EFX"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ELF_EXECUTABLE = FileSignature{ Description: "ELF executable", Header: []byte{0x7f, 0x45, 0x4c, 0x46}, Extensions: []string(nil), Class: "Linux-Unix", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ELITE_PLUS_COMMANDER_GAME_FILE_CDR = FileSignature{ Description: "Elite Plus Commander game file", Header: []byte{0x45, 0x4c, 0x49, 0x54, 0x45, 0x20, 0x43, 0x6f}, Extensions: []string{"CDR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ENCAPSULATED_POSTSCRIPT_FILE_EPS = FileSignature{ Description: "Encapsulated PostScript file", Header: []byte{0x25, 0x21, 0x50, 0x53, 0x2d, 0x41, 0x64, 0x6f}, Extensions: []string{"EPS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ENCASE_CASE_FILE_CAS_CBK = FileSignature{ Description: "EnCase case file", Header: []byte{0x5f, 0x43, 0x41, 0x53, 0x45, 0x5f}, Extensions: []string{"CAS", "CBK"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ENCASE_EVIDENCE_FILE_FORMAT_V2_EX01 = FileSignature{ Description: "EnCase Evidence File Format V2", Header: []byte{0x45, 0x56, 0x46, 0x32, 0xd, 0xa, 0x81}, Extensions: []string{"EX01"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ENDNOTE_LIBRARY_FILE_ENL = FileSignature{ Description: "EndNote Library File", Header: []byte{0x40, 0x40, 0x40, 0x20, 0x0, 0x0, 0x40, 0x40, 0x40, 0x40}, Extensions: []string{"ENL"}, Class: "Miscellaneous", HeaderOffset: 32, Trailer: []byte(nil), }
View Source
var SIG_EXACT_PACKAGER_MODELS_XPT = FileSignature{ Description: "eXact Packager Models", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"XPT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_1_XLS = FileSignature{ Description: "Excel spreadsheet subheader_1", Header: []byte{0x9, 0x8, 0x10, 0x0, 0x0, 0x6, 0x5, 0x0}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_2_XLS = FileSignature{ Description: "Excel spreadsheet subheader_2", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x10}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_3_XLS = FileSignature{ Description: "Excel spreadsheet subheader_3", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x1f}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_4_XLS = FileSignature{ Description: "Excel spreadsheet subheader_4", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x22}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_5_XLS = FileSignature{ Description: "Excel spreadsheet subheader_5", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x23}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_6_XLS = FileSignature{ Description: "Excel spreadsheet subheader_6", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x28}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCEL_SPREADSHEET_SUBHEADER_7_XLS = FileSignature{ Description: "Excel spreadsheet subheader_7", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x29}, Extensions: []string{"XLS"}, Class: "Spreadsheet", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_EXCHANGE_E_MAIL_EML = FileSignature{ Description: "Exchange e-mail", Header: []byte{0x58, 0x2d}, Extensions: []string{"EML"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EXPERT_WITNESS_COMPRESSION_FORMAT_E01 = FileSignature{ Description: "Expert Witness Compression Format", Header: []byte{0x45, 0x56, 0x46, 0x9, 0xd, 0xa, 0xff, 0x0}, Extensions: []string{"E01"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EXTENDED_TCPDUMP_LIBPCAP_CAPTURE_FILE = FileSignature{ Description: "Extended tcpdump (libpcap) capture file", Header: []byte{0xa1, 0xb2, 0xcd, 0x34}, Extensions: []string(nil), Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_EXTENSIBLE_ARCHIVE_FILE_XAR = FileSignature{ Description: "eXtensible ARchive file", Header: []byte{0x78, 0x61, 0x72, 0x21}, Extensions: []string{"XAR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FAT12_FILE_ALLOCATION_TABLE = FileSignature{ Description: "FAT12 File Allocation Table", Header: []byte{0xf0, 0xff, 0xff}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FAT16_FILE_ALLOCATION_TABLE = FileSignature{ Description: "FAT16 File Allocation Table", Header: []byte{0xf8, 0xff, 0xff, 0xff}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FAT32_FILE_ALLOCATION_TABLE_1 = FileSignature{ Description: "FAT32 File Allocation Table_1", Header: []byte{0xf8, 0xff, 0xff, 0xf, 0xff, 0xff, 0xff, 0xf}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FAT32_FILE_ALLOCATION_TABLE_2 = FileSignature{ Description: "FAT32 File Allocation Table_2", Header: []byte{0xf8, 0xff, 0xff, 0xf, 0xff, 0xff, 0xff, 0xff}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FIASCO_DATABASE_DEFINITION_FILE_FDB = FileSignature{ Description: "Fiasco database definition file", Header: []byte{0x46, 0x44, 0x42, 0x48, 0x0}, Extensions: []string{"FDB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FIREBIRD_AND_INTERBASE_DATABASE_FILES_FDB_GDB = FileSignature{ Description: "Firebird and Interbase database files", Header: []byte{0x1, 0x0, 0x39, 0x30}, Extensions: []string{"FDB", "GDB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FLASH_VIDEO_FILE_FLV = FileSignature{ Description: "Flash video file", Header: []byte{0x46, 0x4c, 0x56}, Extensions: []string{"FLV"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FLEXIBLE_IMAGE_TRANSPORT_SYSTEM_FITS_FILE_FITS = FileSignature{ Description: "Flexible Image Transport System (FITS) file", Header: []byte{0x53, 0x49, 0x4d, 0x50, 0x4c, 0x45, 0x20, 0x20, 0x3d, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x54}, Extensions: []string{"FITS"}, Class: "multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FLIC_ANIMATION_FLI = FileSignature{ Description: "FLIC animation", Header: []byte{0x0, 0x11}, Extensions: []string{"FLI"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FLIGHT_SIMULATOR_AIRCRAFT_CONFIGURATION_CFG = FileSignature{ Description: "Flight Simulator Aircraft Configuration", Header: []byte{0x5b, 0x66, 0x6c, 0x74, 0x73, 0x69, 0x6d, 0x2e}, Extensions: []string{"CFG"}, Class: "Games", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FONT_FILE_FON = FileSignature{ Description: "Font file", Header: []byte{0x4d, 0x5a}, Extensions: []string{"FON"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FREEARC_COMPRESSED_FILE_ARC = FileSignature{ Description: "FreeArc compressed file", Header: []byte{0x41, 0x72, 0x43, 0x1}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FREE_LOSSLESS_AUDIO_CODEC_FILE_FLAC = FileSignature{ Description: "Free Lossless Audio Codec file", Header: []byte{0x66, 0x4c, 0x61, 0x43, 0x0, 0x0, 0x0, 0x22}, Extensions: []string{"FLAC"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_FUZZY_BITMAP_FBM_FILE_FBM = FileSignature{ Description: "Fuzzy bitmap (FBM) file", Header: []byte{0x25, 0x62, 0x69, 0x74, 0x6d, 0x61, 0x70}, Extensions: []string{"FBM"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GEM_RASTER_FILE_IMG = FileSignature{ Description: "GEM Raster file", Header: []byte{0xeb, 0x3c, 0x90, 0x2a}, Extensions: []string{"IMG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENEALOGICAL_DATA_COMMUNICATION_GEDCOM_FILE_GED = FileSignature{ Description: "GEnealogical Data COMmunication (GEDCOM) file", Header: []byte{0x30, 0x20, 0x48, 0x45, 0x41, 0x44}, Extensions: []string{"GED"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENERAL_REGULARLY_DISTRIBUTED_INFORMATION_GRIDDED_BINARY_GRB = FileSignature{ Description: "General Regularly-distributed Information (GRIdded) Binary", Header: []byte{0x47, 0x52, 0x49, 0x42}, Extensions: []string{"GRB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENERIC_AUTOCAD_DRAWING_DWG = FileSignature{ Description: "Generic AutoCAD drawing", Header: []byte{0x41, 0x43, 0x31, 0x30}, Extensions: []string{"DWG"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENERIC_DRAWING_PROGRAMS_DRW = FileSignature{ Description: "Generic drawing programs", Header: []byte{0x7}, Extensions: []string{"DRW"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENERIC_E_MAIL_1_EML = FileSignature{ Description: "Generic e-mail_1", Header: []byte{0x52, 0x65, 0x74, 0x75, 0x72, 0x6e, 0x2d, 0x50}, Extensions: []string{"EML"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENERIC_E_MAIL_2_EML = FileSignature{ Description: "Generic e-mail_2", Header: []byte{0x46, 0x72, 0x6f, 0x6d}, Extensions: []string{"EML"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GENETEC_VIDEO_ARCHIVE_G64 = FileSignature{ Description: "Genetec video archive", Header: []byte{0x47, 0x65, 0x6e, 0x65, 0x74, 0x65, 0x63, 0x20, 0x4f, 0x6d, 0x6e, 0x69, 0x63, 0x61, 0x73, 0x74}, Extensions: []string{"G64"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GIF_FILE_GIF = FileSignature{ Description: "GIF file", Header: []byte{0x47, 0x49, 0x46, 0x38}, Extensions: []string{"GIF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0x0, 0x3b}, }
View Source
var SIG_GIMP_FILE_XCF = FileSignature{ Description: "GIMP file", Header: []byte{0x67, 0x69, 0x6d, 0x70, 0x20, 0x78, 0x63, 0x66}, Extensions: []string{"XCF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GIMP_PATTERN_FILE_PAT = FileSignature{ Description: "GIMP pattern file", Header: []byte{0x47, 0x50, 0x41, 0x54}, Extensions: []string{"PAT"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GNU_INFO_READER_FILE_INFO = FileSignature{ Description: "GNU Info Reader file", Header: []byte{0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20}, Extensions: []string{"INFO"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GOOGLE_CHROME_EXTENSION_CRX = FileSignature{ Description: "Google Chrome Extension", Header: []byte{0x43, 0x72, 0x32, 0x34}, Extensions: []string{"CRX"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GOOGLE_EARTH_SESSION_FILE_KMZ = FileSignature{ Description: "Google Earth session file", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"KMZ"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GPG_PUBLIC_KEYRING_GPG = FileSignature{ Description: "GPG public keyring", Header: []byte{0x99}, Extensions: []string{"GPG"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GPS_EXCHANGE_V11_GPX = FileSignature{ Description: "GPS Exchange (v1.1)", Header: []byte{0x3c, 0x67, 0x70, 0x78, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31, 0x2e}, Extensions: []string{"GPX"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_GZIP_ARCHIVE_FILE_GZ = FileSignature{ Description: "GZIP archive file", Header: []byte{0x1f, 0x8b, 0x8}, Extensions: []string{"GZ"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HAMARSOFT_COMPRESSED_ARCHIVE_HAP = FileSignature{ Description: "Hamarsoft compressed archive", Header: []byte{0x91, 0x33, 0x48, 0x46}, Extensions: []string{"HAP"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HARVARD_GRAPHICS_PRESENTATION_FILE_SH3 = FileSignature{ Description: "Harvard Graphics presentation file", Header: []byte{0x48, 0x48, 0x47, 0x42, 0x31}, Extensions: []string{"SH3"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HARVARD_GRAPHICS_PRESENTATION_SHW = FileSignature{ Description: "Harvard Graphics presentation", Header: []byte{0x53, 0x48, 0x4f, 0x57}, Extensions: []string{"SHW"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HARVARD_GRAPHICS_SYMBOL_GRAPHIC_SYW = FileSignature{ Description: "Harvard Graphics symbol graphic", Header: []byte{0x41, 0x4d, 0x59, 0x4f}, Extensions: []string{"SYW"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HUSKYGRAM__POEM__OR_SINGER_EMBROIDERY_CSD = FileSignature{ Description: "Huskygram, Poem, or Singer embroidery", Header: []byte{0x7c, 0x4b, 0xc3, 0x74, 0xe1, 0xc8, 0x53, 0xa4, 0x79, 0xb9, 0x1, 0x1d, 0xfc, 0x4f, 0xdd, 0x13}, Extensions: []string{"CSD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_HUSQVARNA_DESIGNER_HUS = FileSignature{ Description: "Husqvarna Designer", Header: []byte{0x5d, 0xfc, 0xc8, 0x0}, Extensions: []string{"HUS"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_IE_HISTORY_FILE_DAT = FileSignature{ Description: "IE History file", Header: []byte{0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x20, 0x55}, Extensions: []string{"DAT"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_IFF_ANIM_FILE_ANM = FileSignature{ Description: "IFF ANIM file", Header: []byte{0x46, 0x4f, 0x52, 0x4d}, Extensions: []string{"ANM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_IMG_SOFTWARE_BITMAP_IMG = FileSignature{ Description: "Img Software Bitmap", Header: []byte{0x53, 0x43, 0x4d, 0x49}, Extensions: []string{"IMG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INFO2_WINDOWS_RECYCLE_BIN_1 = FileSignature{ Description: "INFO2 Windows recycle bin_1", Header: []byte{0x4, 0x0, 0x0, 0x0}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INFO2_WINDOWS_RECYCLE_BIN_2 = FileSignature{ Description: "INFO2 Windows recycle bin_2", Header: []byte{0x5, 0x0, 0x0, 0x0}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INNO_SETUP_UNINSTALL_LOG_DAT = FileSignature{ Description: "Inno Setup Uninstall Log", Header: []byte{0x49, 0x6e, 0x6e, 0x6f, 0x20, 0x53, 0x65, 0x74}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INSTALLSHIELD_SCRIPT_INS = FileSignature{ Description: "InstallShield Script", Header: []byte{0xb8, 0xc9, 0xc, 0x0}, Extensions: []string{"INS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INSTALL_SHIELD_COMPRESSED_FILE_CAB_HDR = FileSignature{ Description: "Install Shield compressed file", Header: []byte{0x49, 0x53, 0x63, 0x28}, Extensions: []string{"CAB", "HDR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INTEL_PROSET_WIRELESS_PROFILE_P10 = FileSignature{ Description: "Intel PROset-Wireless Profile", Header: []byte{0x64, 0x0, 0x0, 0x0}, Extensions: []string{"P10"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INTERNET_EXPLORER_V11_TRACKING_PROTECTION_LIST_TPL = FileSignature{ Description: "Internet Explorer v11 Tracking Protection List", Header: []byte{0x6d, 0x73, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x4c, 0x69, 0x73, 0x74}, Extensions: []string{"TPL"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_INTER_CTIVE_PAGER_BACKUP_BLACKBERRY_FILE_IPD = FileSignature{ Description: "Inter@ctive Pager Backup (BlackBerry file", Header: []byte{0x49, 0x6e, 0x74, 0x65, 0x72, 0x40, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20, 0x50, 0x61, 0x67, 0x65}, Extensions: []string{"IPD"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ISO_9660_CD_DISC_IMAGE_ISO = FileSignature{ Description: "ISO-9660 CD Disc Image", Header: []byte{0x43, 0x44, 0x30, 0x30, 0x31}, Extensions: []string{"ISO"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ISO_BASE_MEDIA_FILE_MPEG_4_V1_MP4 = FileSignature{ Description: "ISO Base Media file (MPEG-4) v1", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6f, 0x6d}, Extensions: []string{"MP4"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_ISO_MEDIA_MPEG_V4_ITUNES_AVC_LC_FLV_M4V = FileSignature{ Description: "ISO Media-MPEG v4-iTunes AVC-LC", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x4d, 0x34, 0x56, 0x20}, Extensions: []string{"FLV", "M4V"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_JARCS_COMPRESSED_ARCHIVE_JAR = FileSignature{ Description: "JARCS compressed archive", Header: []byte{0x4a, 0x41, 0x52, 0x43, 0x53, 0x0}, Extensions: []string{"JAR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAR_ARCHIVE_JAR = FileSignature{ Description: "Jar archive", Header: []byte{0x5f, 0x27, 0xa8, 0x89}, Extensions: []string{"JAR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVAKEYSTORE = FileSignature{ Description: "JavaKeyStore", Header: []byte{0xfe, 0xed, 0xfe, 0xed}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVA_ARCHIVE_1_JAR = FileSignature{ Description: "Java archive_1", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"JAR"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVA_ARCHIVE_2_JAR = FileSignature{ Description: "Java archive_2", Header: []byte{0x50, 0x4b, 0x3, 0x4, 0x14, 0x0, 0x8, 0x0}, Extensions: []string{"JAR"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVA_BYTECODE_CLASS = FileSignature{ Description: "Java bytecode", Header: []byte{0xca, 0xfe, 0xba, 0xbe}, Extensions: []string{"CLASS"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVA_CRYPTOGRAPHY_EXTENSION_KEYSTORE_JCEKS = FileSignature{ Description: "Java Cryptography Extension keystore", Header: []byte{0xce, 0xce, 0xce, 0xce}, Extensions: []string{"JCEKS"}, Class: "Encryption", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JAVA_SERIALIZATION_DATA = FileSignature{ Description: "Java serialization data", Header: []byte{0xac, 0xed}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JBOG2_IMAGE_FILE_JB2 = FileSignature{ Description: "JBOG2 image file", Header: []byte{0x97, 0x4a, 0x42, 0x32, 0xd, 0xa, 0x1a, 0xa}, Extensions: []string{"JB2"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0x3, 0x33, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0}, }
View Source
var SIG_JEPPESEN_FLITELOG_FILE_LBK = FileSignature{ Description: "Jeppesen FliteLog file", Header: []byte{0xc8, 0x0, 0x79, 0x0}, Extensions: []string{"LBK"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JPEG2000_IMAGE_FILES_JP2 = FileSignature{ Description: "JPEG2000 image files", Header: []byte{0x0, 0x0, 0x0, 0xc, 0x6a, 0x50, 0x20, 0x20}, Extensions: []string{"JP2"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_JPEG_EXIF_SPIFF_IMAGES_JFIF_JPE_JPEG_JPG = FileSignature{ Description: "JPEG-EXIF-SPIFF images", Header: []byte{0xff, 0xd8, 0xff}, Extensions: []string{"JFIF", "JPE", "JPEG", "JPG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0xff, 0xd9}, }
View Source
var SIG_KEYBOARD_DRIVER_FILE_SYS = FileSignature{ Description: "Keyboard driver file", Header: []byte{0xff, 0x4b, 0x45, 0x59, 0x42, 0x20, 0x20, 0x20}, Extensions: []string{"SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_KGB_ARCHIVE_KGB = FileSignature{ Description: "KGB archive", Header: []byte{0x4b, 0x47, 0x42, 0x5f, 0x61, 0x72, 0x63, 0x68}, Extensions: []string{"KGB"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_KODAK_CINEON_IMAGE_CIN = FileSignature{ Description: "Kodak Cineon image", Header: []byte{0x80, 0x2a, 0x5f, 0xd7}, Extensions: []string{"CIN"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_KWAJ_COMPRESSED_FILE = FileSignature{ Description: "KWAJ (compressed) file", Header: []byte{0x4b, 0x57, 0x41, 0x4a, 0x88, 0xf0, 0x27, 0xd1}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_KWORD_DOCUMENT_KWD = FileSignature{ Description: "KWord document", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"KWD"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LH_ARCHIVE_OLD_VERS_TYPE_1_ARC = FileSignature{ Description: "LH archive (old vers.-type 1)", Header: []byte{0x1a, 0x2}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LH_ARCHIVE_OLD_VERS_TYPE_2_ARC = FileSignature{ Description: "LH archive (old vers.-type 2)", Header: []byte{0x1a, 0x3}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LH_ARCHIVE_OLD_VERS_TYPE_3_ARC = FileSignature{ Description: "LH archive (old vers.-type 3)", Header: []byte{0x1a, 0x4}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LH_ARCHIVE_OLD_VERS_TYPE_4_ARC = FileSignature{ Description: "LH archive (old vers.-type 4)", Header: []byte{0x1a, 0x8}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LH_ARCHIVE_OLD_VERS_TYPE_5_ARC = FileSignature{ Description: "LH archive (old vers.-type 5)", Header: []byte{0x1a, 0x9}, Extensions: []string{"ARC"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LIBRARY_CACHE_FILE_AX = FileSignature{ Description: "Library cache file", Header: []byte{0x4d, 0x5a}, Extensions: []string{"AX"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOGICAL_FILE_EVIDENCE_FORMAT_E01 = FileSignature{ Description: "Logical File Evidence Format", Header: []byte{0x4c, 0x56, 0x46, 0x9, 0xd, 0xa, 0xff, 0x0}, Extensions: []string{"E01"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_1_2_3_V1_WK1 = FileSignature{ Description: "Lotus 1-2-3 (v1)", Header: []byte{0x0, 0x0, 0x2, 0x0, 0x6, 0x4, 0x6, 0x0}, Extensions: []string{"WK1"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_1_2_3_V3_WK3 = FileSignature{ Description: "Lotus 1-2-3 (v3)", Header: []byte{0x0, 0x0, 0x1a, 0x0, 0x0, 0x10, 0x4, 0x0}, Extensions: []string{"WK3"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_1_2_3_V4_V5_WK4_WK5 = FileSignature{ Description: "Lotus 1-2-3 (v4-v5)", Header: []byte{0x0, 0x0, 0x1a, 0x0, 0x2, 0x10, 0x4, 0x0}, Extensions: []string{"WK4", "WK5"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_1_2_3_V9_123 = FileSignature{ Description: "Lotus 1-2-3 (v9)", Header: []byte{0x0, 0x0, 0x1a, 0x0, 0x5, 0x10, 0x4}, Extensions: []string{"123"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_AMI_PRO_DOCUMENT_1_SAM = FileSignature{ Description: "Lotus AMI Pro document_1", Header: []byte{0x5b, 0x56, 0x45, 0x52, 0x5d}, Extensions: []string{"SAM"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_AMI_PRO_DOCUMENT_2_SAM = FileSignature{ Description: "Lotus AMI Pro document_2", Header: []byte{0x5b, 0x76, 0x65, 0x72, 0x5d}, Extensions: []string{"SAM"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_IBM_APPROACH_97_FILE_APR = FileSignature{ Description: "Lotus-IBM Approach 97 file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"APR"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_NOTES_DATABASE_NSF = FileSignature{ Description: "Lotus Notes database", Header: []byte{0x1a, 0x0, 0x0, 0x4, 0x0, 0x0}, Extensions: []string{"NSF"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_NOTES_DATABASE_TEMPLATE_NTF = FileSignature{ Description: "Lotus Notes database template", Header: []byte{0x1a, 0x0, 0x0}, Extensions: []string{"NTF"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_LOTUS_WORDPRO_FILE_LWP = FileSignature{ Description: "Lotus WordPro file", Header: []byte{0x57, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f}, Extensions: []string{"LWP"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MACINTOSH_ENCRYPTED_DISK_IMAGE_V1_DMG = FileSignature{ Description: "Macintosh encrypted Disk image (v1)", Header: []byte{0x63, 0x64, 0x73, 0x61, 0x65, 0x6e, 0x63, 0x72}, Extensions: []string{"DMG"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MACINTOSH_ENCRYPTED_DISK_IMAGE_V2_DMG = FileSignature{ Description: "Macintosh encrypted Disk image (v2)", Header: []byte{0x65, 0x6e, 0x63, 0x72, 0x63, 0x64, 0x73, 0x61}, Extensions: []string{"DMG"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MACOS_X_DASHBOARD_WIDGET_ZIP = FileSignature{ Description: "MacOS X Dashboard Widget", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"ZIP"}, Class: "MacOS", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MACOS_X_IMAGE_FILE_DMG = FileSignature{ Description: "MacOS X image file", Header: []byte{0x78, 0x1, 0x73, 0xd, 0x62, 0x62, 0x60}, Extensions: []string{"DMG"}, Class: "MacOS", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MACROMEDIA_SHOCKWAVE_FLASH_SWF = FileSignature{ Description: "Macromedia Shockwave Flash", Header: []byte{0x5a, 0x57, 0x53}, Extensions: []string{"SWF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MAC_DISK_IMAGE_BZ2_COMPRESSED_DMG = FileSignature{ Description: "Mac Disk image (BZ2 compressed)", Header: []byte{0x42, 0x5a, 0x68}, Extensions: []string{"DMG"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MAPINFO_INTERCHANGE_FORMAT_FILE_MIF = FileSignature{ Description: "MapInfo Interchange Format file", Header: []byte{0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x20}, Extensions: []string{"MIF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MAPINFO_NATIVE_DATA_FORMAT_DAT = FileSignature{ Description: "MapInfo Native Data Format", Header: []byte{0x3}, Extensions: []string{"DAT"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MAPINFO_SEA_CHART_BSB = FileSignature{ Description: "MapInfo Sea Chart", Header: []byte{0x21}, Extensions: []string{"BSB"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MAR_COMPRESSED_ARCHIVE_MAR = FileSignature{ Description: "MAr compressed archive", Header: []byte{0x4d, 0x41, 0x72, 0x30, 0x0}, Extensions: []string{"MAR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MATERIAL_EXCHANGE_FORMAT_MXF = FileSignature{ Description: "Material Exchange Format", Header: []byte{0x6, 0xe, 0x2b, 0x34, 0x2, 0x5, 0x1, 0x1, 0xd, 0x1, 0x2, 0x1, 0x1, 0x2}, Extensions: []string{"MXF"}, Class: "Media", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MATLAB_V5_WORKSPACE_MAT = FileSignature{ Description: "MATLAB v5 workspace", Header: []byte{0x4d, 0x41, 0x54, 0x4c, 0x41, 0x42, 0x20, 0x35, 0x2e, 0x30, 0x20, 0x4d, 0x41, 0x54, 0x2d, 0x66, 0x69, 0x6c, 0x65}, Extensions: []string{"MAT"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MATROSKA_STREAM_FILE_1_MKV = FileSignature{ Description: "Matroska stream file_1", Header: []byte{0x1a, 0x45, 0xdf, 0xa3}, Extensions: []string{"MKV"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MATROSKA_STREAM_FILE_2_MKV = FileSignature{ Description: "Matroska stream file_2", Header: []byte{0x1a, 0x45, 0xdf, 0xa3, 0x93, 0x42, 0x82, 0x88}, Extensions: []string{"MKV"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MBOX_TABLE_OF_CONTENTS_FILE = FileSignature{ Description: "Mbox table of contents file", Header: []byte{0x0, 0xd, 0xbb, 0xa0}, Extensions: []string(nil), Class: "E-mail", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MERRIAM_WEBSTER_POCKET_DICTIONARY_PDB = FileSignature{ Description: "Merriam-Webster Pocket Dictionary", Header: []byte{0x4d, 0x2d, 0x57, 0x20, 0x50, 0x6f, 0x63, 0x6b}, Extensions: []string{"PDB"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROGRAFX_DESIGNER_GRAPHIC_DS4 = FileSignature{ Description: "Micrografx Designer graphic", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"DS4"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROGRAFX_VECTOR_GRAPHIC_FILE_DRW = FileSignature{ Description: "Micrografx vector graphic file", Header: []byte{0x1, 0xff, 0x2, 0x4, 0x3, 0x2}, Extensions: []string{"DRW"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_ACCESS_2007_ACCDB = FileSignature{ Description: "Microsoft Access 2007", Header: []byte{0x0, 0x1, 0x0, 0x0, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x20, 0x41, 0x43, 0x45, 0x20, 0x44, 0x42}, Extensions: []string{"ACCDB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_ACCESS_MDB = FileSignature{ Description: "Microsoft Access", Header: []byte{0x0, 0x1, 0x0, 0x0, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x20, 0x4a, 0x65, 0x74, 0x20, 0x44, 0x42}, Extensions: []string{"MDB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_CABINET_FILE_CAB = FileSignature{ Description: "Microsoft cabinet file", Header: []byte{0x4d, 0x53, 0x43, 0x46}, Extensions: []string{"CAB"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_CODE_PAGE_TRANSLATION_FILE_CPX = FileSignature{ Description: "Microsoft Code Page Translation file", Header: []byte{0x5b, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73}, Extensions: []string{"CPX"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_COMMON_CONSOLE_DOCUMENT_MSC = FileSignature{ Description: "Microsoft Common Console Document", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"MSC"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_INSTALLER_PACKAGE_MSI = FileSignature{ Description: "Microsoft Installer package", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"MSI"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_INSTALLER_PATCH_MSP = FileSignature{ Description: "Microsoft Installer Patch", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"MSP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_MONEY_FILE_MNY = FileSignature{ Description: "Microsoft Money file", Header: []byte{0x0, 0x1, 0x0, 0x0, 0x4d, 0x53, 0x49, 0x53, 0x41, 0x4d, 0x20, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65}, Extensions: []string{"MNY"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_MSN_MARC_ARCHIVE_MAR = FileSignature{ Description: "Microsoft-MSN MARC archive", Header: []byte{0x4d, 0x41, 0x52, 0x43}, Extensions: []string{"MAR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_OFFICE_DOCUMENT_DOC_DOT_PPS_PPT_XLA_XLS_WIZ = FileSignature{ Description: "Microsoft Office document", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"DOC", "DOT", "PPS", "PPT", "XLA", "XLS", "WIZ"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_OPEN_XML_PAPER_SPECIFICATION_OXPS = FileSignature{ Description: "Microsoft Open XML paper specification", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"OXPS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_OUTLOOK_EXCHANGE_OFFLINE_STORAGE_FOLDER_OST = FileSignature{ Description: "Microsoft Outlook Exchange Offline Storage Folder", Header: []byte{0x21, 0x42, 0x44, 0x4e}, Extensions: []string{"OST"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_WINDOWS_IMAGING_FORMAT_WIM = FileSignature{ Description: "Microsoft Windows Imaging Format", Header: []byte{0x4d, 0x53, 0x57, 0x49, 0x4d}, Extensions: []string{"WIM"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MICROSOFT_WINDOWS_USER_STATE_MIGRATION_TOOL_PMOCCMOC = FileSignature{ Description: "Microsoft Windows User State Migration Tool", Header: []byte{0x50, 0x4d, 0x4f, 0x43, 0x43, 0x4d, 0x4f, 0x43}, Extensions: []string{"PMOCCMOC"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MIDI_SOUND_FILE_MID_MIDI = FileSignature{ Description: "MIDI sound file", Header: []byte{0x4d, 0x54, 0x68, 0x64}, Extensions: []string{"MID", "MIDI"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MILESTONES_PROJECT_MANAGEMENT_FILE_1_MLS = FileSignature{ Description: "Milestones project management file_1", Header: []byte{0x4d, 0x56, 0x32, 0x31, 0x34}, Extensions: []string{"MLS"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MILESTONES_PROJECT_MANAGEMENT_FILE_2_MLS = FileSignature{ Description: "Milestones project management file_2", Header: []byte{0x4d, 0x56, 0x32, 0x43}, Extensions: []string{"MLS"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MILESTONES_PROJECT_MANAGEMENT_FILE_MLS = FileSignature{ Description: "Milestones project management file", Header: []byte{0x4d, 0x49, 0x4c, 0x45, 0x53}, Extensions: []string{"MLS"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MINITAB_DATA_FILE_MTW = FileSignature{ Description: "Minitab data file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"MTW"}, Class: "Statistics", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MMC_SNAP_IN_CONTROL_FILE_MSC = FileSignature{ Description: "MMC Snap-in Control file", Header: []byte{0x3c, 0x3f, 0x78, 0x6d, 0x6c, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31, 0x2e, 0x30, 0x22, 0x3f, 0x3e, 0xd, 0xa, 0x3c, 0x4d, 0x4d, 0x43, 0x5f, 0x43, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x73, 0x6f, 0x6c, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22}, Extensions: []string{"MSC"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MONOCHROME_PICTURE_TIFF_BITMAP_MP = FileSignature{ Description: "Monochrome Picture TIFF bitmap", Header: []byte{0xc, 0xed}, Extensions: []string{"MP"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MOZILLA_ARCHIVE_MAR = FileSignature{ Description: "Mozilla archive", Header: []byte{0x4d, 0x41, 0x52, 0x31, 0x0}, Extensions: []string{"MAR"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MOZILLA_BROWSER_ARCHIVE_XPI = FileSignature{ Description: "Mozilla Browser Archive", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"XPI"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MP3_AUDIO_FILE_MP3 = FileSignature{ Description: "MP3 audio file", Header: []byte{0x49, 0x44, 0x33}, Extensions: []string{"MP3"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_2_AAC_AUDIO_AAC = FileSignature{ Description: "MPEG-2 AAC audio", Header: []byte{0xff, 0xf9}, Extensions: []string{"AAC"}, Class: "Audio", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_AAC_AUDIO_AAC = FileSignature{ Description: "MPEG-4 AAC audio", Header: []byte{0xff, 0xf1}, Extensions: []string{"AAC"}, Class: "Audio", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_V1_MP4 = FileSignature{ Description: "MPEG-4 v1", Header: []byte{0x0, 0x0, 0x0, 0x14, 0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6f, 0x6d}, Extensions: []string{"MP4"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_VIDEO_1_3GP5_M4V_MP4 = FileSignature{ Description: "MPEG-4 video_1", Header: []byte{0x0, 0x0, 0x0, 0x18, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"3GP5", "M4V", "MP4"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_VIDEO_2_MP4 = FileSignature{ Description: "MPEG-4 video_2", Header: []byte{0x0, 0x0, 0x0, 0x1c, 0x66, 0x74, 0x79, 0x70}, Extensions: []string{"MP4"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_VIDEO_FILE_1_MP4 = FileSignature{ Description: "MPEG-4 video file_1", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x33, 0x67, 0x70, 0x35}, Extensions: []string{"MP4"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_VIDEO_FILE_2_MP4 = FileSignature{ Description: "MPEG-4 video file_2", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x4d, 0x53, 0x4e, 0x56}, Extensions: []string{"MP4"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_MPEG_4_VIDEO_QUICKTIME_FILE_M4V = FileSignature{ Description: "MPEG-4 video-QuickTime file", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x6d, 0x70, 0x34, 0x32}, Extensions: []string{"M4V"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_MPEG_VIDEO_FILE_MPG = FileSignature{ Description: "MPEG video file", Header: []byte{0x0, 0x0, 0x1, 0xb3}, Extensions: []string{"MPG"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte{0x0, 0x0, 0x1, 0xb7}, }
View Source
var SIG_MSINFO_FILE_MOF = FileSignature{ Description: "MSinfo file", Header: []byte{0xff, 0xfe, 0x23, 0x0, 0x6c, 0x0, 0x69, 0x0}, Extensions: []string{"MOF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MSWORKS_DATABASE_FILE_DB = FileSignature{ Description: "MSWorks database file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"DB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MSWORKS_TEXT_DOCUMENT_WPS = FileSignature{ Description: "MSWorks text document", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"WPS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_ACCESS_SNAPSHOT_VIEWER_FILE_SNP = FileSignature{ Description: "MS Access Snapshot Viewer file", Header: []byte{0x4d, 0x53, 0x43, 0x46}, Extensions: []string{"SNP"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_AGENT_CHARACTER_FILE_ACS = FileSignature{ Description: "MS Agent Character file", Header: []byte{0xc3, 0xab, 0xcd, 0xab}, Extensions: []string{"ACS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_ANSWER_WIZARD_AW = FileSignature{ Description: "MS Answer Wizard", Header: []byte{0x8a, 0x1, 0x9, 0x0, 0x0, 0x0, 0xe1, 0x8}, Extensions: []string{"AW"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_AUDIO_COMPRESSION_MANAGER_DRIVER_ACM = FileSignature{ Description: "MS audio compression manager driver", Header: []byte{0x4d, 0x5a}, Extensions: []string{"ACM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_COFF_RELOCATABLE_OBJECT_CODE_OBJ = FileSignature{ Description: "MS COFF relocatable object code", Header: []byte{0x4c, 0x1}, Extensions: []string{"OBJ"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_COMPILED_HTML_HELP_FILE_CHI_CHM = FileSignature{ Description: "MS Compiled HTML Help File", Header: []byte{0x49, 0x54, 0x53, 0x46}, Extensions: []string{"CHI", "CHM"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_CPP_DEBUGGING_SYMBOLS_FILE_PDB = FileSignature{ Description: "MS C++ debugging symbols file", Header: []byte{0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, 0x2f, 0x43, 0x2b, 0x2b, 0x20}, Extensions: []string{"PDB"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_DEVELOPER_STUDIO_PROJECT_FILE_DSP = FileSignature{ Description: "MS Developer Studio project file", Header: []byte{0x23, 0x20, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73}, Extensions: []string{"DSP"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_DOCUMENT_IMAGING_FILE_MDI = FileSignature{ Description: "MS Document Imaging file", Header: []byte{0x45, 0x50}, Extensions: []string{"MDI"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_EXCHANGE_CONFIGURATION_FILE_ECF = FileSignature{ Description: "MS Exchange configuration file", Header: []byte{0x5b, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x6c}, Extensions: []string{"ECF"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_FAX_COVER_SHEET_CPE = FileSignature{ Description: "MS Fax Cover Sheet", Header: []byte{0x46, 0x41, 0x58, 0x43, 0x4f, 0x56, 0x45, 0x52}, Extensions: []string{"CPE"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_OFFICE_2007_DOCUMENTS_DOCX_PPTX_XLSX = FileSignature{ Description: "MS Office 2007 documents", Header: []byte{0x50, 0x4b, 0x3, 0x4, 0x14, 0x0, 0x6, 0x0}, Extensions: []string{"DOCX", "PPTX", "XLSX"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_OFFICE_OPEN_XML_FORMAT_DOCUMENT_DOCX_PPTX_XLSX = FileSignature{ Description: "MS Office Open XML Format Document", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"DOCX", "PPTX", "XLSX"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_ONENOTE_NOTE_ONE = FileSignature{ Description: "MS OneNote note", Header: []byte{0xe4, 0x52, 0x5c, 0x7b, 0x8c, 0xd8, 0xa7, 0x4d}, Extensions: []string{"ONE"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_PUBLISHER_BDR = FileSignature{ Description: "MS Publisher", Header: []byte{0x58, 0x54}, Extensions: []string{"BDR"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_PUBLISHER_FILE_PUB = FileSignature{ Description: "MS Publisher file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"PUB"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_PUBLISHER_FILE_SUBHEADER_PUB = FileSignature{ Description: "MS Publisher file subheader", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x2}, Extensions: []string{"PUB"}, Class: "Word processing suite", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_MS_PUBLISHER_SUBHEADER_PUB = FileSignature{ Description: "MS Publisher subheader", Header: []byte{0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x0}, Extensions: []string{"PUB"}, Class: "Word processing", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_MS_READER_EBOOK_LIT = FileSignature{ Description: "MS Reader eBook", Header: []byte{0x49, 0x54, 0x4f, 0x4c, 0x49, 0x54, 0x4c, 0x53}, Extensions: []string{"LIT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_SECURITY_CATALOG_FILE_CAT = FileSignature{ Description: "MS security catalog file", Header: []byte{0x30}, Extensions: []string{"CAT"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_VISUAL_STUDIO_WORKSPACE_FILE_DSW = FileSignature{ Description: "MS Visual Studio workspace file", Header: []byte{0x64, 0x73, 0x77, 0x66, 0x69, 0x6c, 0x65}, Extensions: []string{"DSW"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_WINDOWS_JOURNAL_JNT_JTP = FileSignature{ Description: "MS Windows journal", Header: []byte{0x4e, 0x42, 0x2a, 0x0}, Extensions: []string{"JNT", "JTP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_WINMOBILE_PERSONAL_NOTE_PWI = FileSignature{ Description: "MS WinMobile personal note", Header: []byte{0x7b, 0x5c, 0x70, 0x77, 0x69}, Extensions: []string{"PWI"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_WRITE_FILE_1_WRI = FileSignature{ Description: "MS Write file_1", Header: []byte{0x31, 0xbe}, Extensions: []string{"WRI"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_WRITE_FILE_2_WRI = FileSignature{ Description: "MS Write file_2", Header: []byte{0x32, 0xbe}, Extensions: []string{"WRI"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MS_WRITE_FILE_3_WRI = FileSignature{ Description: "MS Write file_3", Header: []byte{0xbe, 0x0, 0x0, 0x0, 0xab}, Extensions: []string{"WRI"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MULTIBIT_BITCOIN_BLOCKCHAIN_FILE_SPVB = FileSignature{ Description: "MultiBit Bitcoin blockchain file", Header: []byte{0x53, 0x50, 0x56, 0x42}, Extensions: []string{"SPVB"}, Class: "e-money", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MULTIBIT_BITCOIN_WALLET_FILE_WALLET = FileSignature{ Description: "MultiBit Bitcoin wallet file", Header: []byte{0xa, 0x16, 0x6f, 0x72, 0x67, 0x2e, 0x62, 0x69, 0x74, 0x63, 0x6f, 0x69, 0x6e, 0x2e, 0x70, 0x72}, Extensions: []string{"WALLET"}, Class: "e-money", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_MULTIBIT_BITCOIN_WALLET_INFORMATION_INFO = FileSignature{ Description: "MultiBit Bitcoin wallet information", Header: []byte{0x6d, 0x75, 0x6c, 0x74, 0x69, 0x42, 0x69, 0x74, 0x2e, 0x69, 0x6e, 0x66, 0x6f}, Extensions: []string{"INFO"}, Class: "E-money", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NATIONAL_IMAGERY_TRANSMISSION_FORMAT_FILE_NTF = FileSignature{ Description: "National Imagery Transmission Format file", Header: []byte{0x4e, 0x49, 0x54, 0x46, 0x30}, Extensions: []string{"NTF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NATIONAL_TRANSFER_FORMAT_MAP_NTF = FileSignature{ Description: "National Transfer Format Map", Header: []byte{0x30, 0x31, 0x4f, 0x52, 0x44, 0x4e, 0x41, 0x4e}, Extensions: []string{"NTF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NAV_QUARANTINED_VIRUS_FILE = FileSignature{ Description: "NAV quarantined virus file", Header: []byte{0xcd, 0x20, 0xaa, 0xaa, 0x2, 0x0, 0x0, 0x0}, Extensions: []string(nil), Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NERO_CD_COMPILATION_NRI = FileSignature{ Description: "Nero CD compilation", Header: []byte{0xe, 0x4e, 0x65, 0x72, 0x6f, 0x49, 0x53, 0x4f}, Extensions: []string{"NRI"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NES_SOUND_FILE_NSF = FileSignature{ Description: "NES Sound file", Header: []byte{0x4e, 0x45, 0x53, 0x4d, 0x1a, 0x1}, Extensions: []string{"NSF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NETSCAPE_COMMUNICATOR_V4_MAIL_FOLDER_SNM = FileSignature{ Description: "Netscape Communicator (v4) mail folder", Header: []byte{0x0, 0x1e, 0x84, 0x90, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"SNM"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NETSCAPE_NAVIGATOR_V4_DATABASE_DB = FileSignature{ Description: "Netscape Navigator (v4) database", Header: []byte{0x0, 0x6, 0x15, 0x61, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0xd2, 0x0, 0x0, 0x10, 0x0}, Extensions: []string{"DB"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NEXT_SUN_MICROSYSTEMS_AUDIO_FILE_AU = FileSignature{ Description: "NeXT-Sun Microsystems audio file", Header: []byte{0x2e, 0x73, 0x6e, 0x64}, Extensions: []string{"AU"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NORTON_DISK_DOCTOR_UNDO_FILE_DAT = FileSignature{ Description: "Norton Disk Doctor undo file", Header: []byte{0x50, 0x4e, 0x43, 0x49, 0x55, 0x4e, 0x44, 0x4f}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NOVELL_LANALYZER_CAPTURE_FILE_TR1 = FileSignature{ Description: "Novell LANalyzer capture file", Header: []byte{0x1, 0x10}, Extensions: []string{"TR1"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NTFS_MFT_BAAD = FileSignature{ Description: "NTFS MFT (BAAD)", Header: []byte{0x42, 0x41, 0x41, 0x44}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_NTFS_MFT_FILE = FileSignature{ Description: "NTFS MFT (FILE)", Header: []byte{0x46, 0x49, 0x4c, 0x45}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OGG_VORBIS_CODEC_COMPRESSED_FILE_OGA_OGG_OGV_OGX = FileSignature{ Description: "Ogg Vorbis Codec compressed file", Header: []byte{0x4f, 0x67, 0x67, 0x53, 0x0, 0x2, 0x0, 0x0}, Extensions: []string{"OGA", "OGG", "OGV", "OGX"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OLE_OBJECT_LIBRARY_OLB = FileSignature{ Description: "OLE object library", Header: []byte{0x4d, 0x5a}, Extensions: []string{"OLB"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OLE_SPSS_VISUAL_CPP_LIBRARY_FILE_TLB = FileSignature{ Description: "OLE-SPSS-Visual C++ library file", Header: []byte{0x4d, 0x53, 0x46, 0x54, 0x2, 0x0, 0x1, 0x0}, Extensions: []string{"TLB"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ONENOTE_PACKAGE_ONEPKG = FileSignature{ Description: "OneNote Package", Header: []byte{0x4d, 0x53, 0x43, 0x46}, Extensions: []string{"ONEPKG"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OPENDOCUMENT_TEMPLATE_ODT_ODP_OTT = FileSignature{ Description: "OpenDocument template", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"ODT", "ODP", "OTT"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OPENEXR_BITMAP_IMAGE_EXR = FileSignature{ Description: "OpenEXR bitmap image", Header: []byte{0x76, 0x2f, 0x31, 0x1}, Extensions: []string{"EXR"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OPENOFFICE_DOCUMENTS_SXC_SXD_SXI_SXW = FileSignature{ Description: "OpenOffice documents", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"SXC", "SXD", "SXI", "SXW"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OPENTYPE_FONT_OTF = FileSignature{ Description: "OpenType font", Header: []byte{0x4f, 0x54, 0x54, 0x4f, 0x0}, Extensions: []string{"OTF"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OPEN_PUBLICATION_STRUCTURE_EBOOK_EPUB = FileSignature{ Description: "Open Publication Structure eBook", Header: []byte{0x50, 0x4b, 0x3, 0x4, 0xa, 0x0, 0x2, 0x0}, Extensions: []string{"EPUB"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OS_X_ABI_MACH_O_BINARY_32_BIT = FileSignature{ Description: "OS X ABI Mach-O binary (32-bit)", Header: []byte{0xfe, 0xed, 0xfa, 0xce}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OS_X_ABI_MACH_O_BINARY_32_BIT_REVERSE = FileSignature{ Description: "OS X ABI Mach-O binary (32-bit reverse)", Header: []byte{0xce, 0xfa, 0xed, 0xfe}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OS_X_ABI_MACH_O_BINARY_64_BIT = FileSignature{ Description: "OS X ABI Mach-O binary (64-bit)", Header: []byte{0xfe, 0xed, 0xfa, 0xcf}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OS_X_ABI_MACH_O_BINARY_64_BIT_REVERSE = FileSignature{ Description: "OS X ABI Mach-O binary (64-bit reverse)", Header: []byte{0xcf, 0xfa, 0xed, 0xfe}, Extensions: []string(nil), Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OUTLOOK_ADDRESS_FILE_WAB = FileSignature{ Description: "Outlook address file", Header: []byte{0x9c, 0xcb, 0xcb, 0x8d, 0x13, 0x75, 0xd2, 0x11}, Extensions: []string{"WAB"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OUTLOOK_EXCHANGE_MESSAGE_SUBHEADER_MSG = FileSignature{ Description: "Outlook-Exchange message subheader", Header: []byte{0x52, 0x0, 0x6f, 0x0, 0x6f, 0x0, 0x74, 0x0, 0x20, 0x0, 0x45, 0x0, 0x6e, 0x0, 0x74, 0x0, 0x72, 0x0, 0x79, 0x0}, Extensions: []string{"MSG"}, Class: "Email", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_OUTLOOK_EXPRESS_ADDRESS_BOOK_WIN95_WAB = FileSignature{ Description: "Outlook Express address book (Win95)", Header: []byte{0x81, 0x32, 0x84, 0xc1, 0x85, 0x5, 0xd0, 0x11}, Extensions: []string{"WAB"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_OUTLOOK_EXPRESS_E_MAIL_FOLDER_DBX = FileSignature{ Description: "Outlook Express e-mail folder", Header: []byte{0xcf, 0xad, 0x12, 0xfe}, Extensions: []string{"DBX"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PACKET_SNIFFER_FILES_CAP = FileSignature{ Description: "Packet sniffer files", Header: []byte{0x58, 0x43, 0x50, 0x0}, Extensions: []string{"CAP"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALMOS_SUPERMEMO_PDB = FileSignature{ Description: "PalmOS SuperMemo", Header: []byte{0x73, 0x6d, 0x5f}, Extensions: []string{"PDB"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALMPILOT_RESOURCE_FILE_PRC = FileSignature{ Description: "Palmpilot resource file", Header: []byte{0x42, 0x4f, 0x4f, 0x4b, 0x4d, 0x4f, 0x42, 0x49}, Extensions: []string{"PRC"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALM_ADDRESS_BOOK_ARCHIVE_ABA = FileSignature{ Description: "Palm Address Book Archive", Header: []byte{0x0, 0x1, 0x42, 0x41}, Extensions: []string{"ABA"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALM_DATEBOOK_ARCHIVE_DBA = FileSignature{ Description: "Palm DateBook Archive", Header: []byte{0x0, 0x1, 0x42, 0x44}, Extensions: []string{"DBA"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALM_DESKTOP_DATEBOOK_DAT = FileSignature{ Description: "Palm Desktop DateBook", Header: []byte{0xbe, 0xba, 0xfe, 0xca, 0xf, 0x50, 0x61, 0x6c, 0x6d, 0x53, 0x47, 0x20, 0x44, 0x61, 0x74, 0x61}, Extensions: []string{"DAT"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PALM_ZIRE_PHOTO_DATABASE_DB = FileSignature{ Description: "Palm Zire photo database", Header: []byte{0x44, 0x42, 0x46, 0x48}, Extensions: []string{"DB"}, Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PARROT_VIDEO_ENCAPSULATION = FileSignature{ Description: "Parrot Video Encapsulation", Header: []byte{0x50, 0x61, 0x56, 0x45}, Extensions: []string(nil), Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PATHWAY_MAP_FILE_PRC = FileSignature{ Description: "PathWay Map file", Header: []byte{0x74, 0x42, 0x4d, 0x50, 0x4b, 0x6e, 0x57, 0x72}, Extensions: []string{"PRC"}, Class: "Mobile", HeaderOffset: 60, Trailer: []byte(nil), }
View Source
var SIG_PAX_PASSWORD_PROTECTED_BITMAP_PAX = FileSignature{ Description: "PAX password protected bitmap", Header: []byte{0x50, 0x41, 0x58}, Extensions: []string{"PAX"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PCX_BITMAP_DCX = FileSignature{ Description: "PCX bitmap", Header: []byte{0xb1, 0x68, 0xde, 0x3a}, Extensions: []string{"DCX"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PDF_FILE_PDF_FDF = FileSignature{ Description: "PDF file", Header: []byte{0x25, 0x50, 0x44, 0x46}, Extensions: []string{"PDF", "FDF"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte{0x25, 0x25, 0x45, 0x4f, 0x46}, }
View Source
var SIG_PERFECT_OFFICE_DOCUMENT_DOC = FileSignature{ Description: "Perfect Office document", Header: []byte{0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1, 0x0}, Extensions: []string{"DOC"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PESTPATROL_DATA_SCAN_STRINGS_DAT = FileSignature{ Description: "PestPatrol data-scan strings", Header: []byte{0x50, 0x45, 0x53, 0x54}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PFAFF_HOME_EMBROIDERY_PCS = FileSignature{ Description: "Pfaff Home Embroidery", Header: []byte{0x32, 0x3, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0}, Extensions: []string{"PCS"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PGP_DISK_IMAGE_PGD = FileSignature{ Description: "PGP disk image", Header: []byte{0x50, 0x47, 0x50, 0x64, 0x4d, 0x41, 0x49, 0x4e}, Extensions: []string{"PGD"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PGP_PUBLIC_KEYRING_PKR = FileSignature{ Description: "PGP public keyring", Header: []byte{0x99, 0x1}, Extensions: []string{"PKR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PGP_SECRET_KEYRING_1_SKR = FileSignature{ Description: "PGP secret keyring_1", Header: []byte{0x95, 0x0}, Extensions: []string{"SKR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PGP_SECRET_KEYRING_2_SKR = FileSignature{ Description: "PGP secret keyring_2", Header: []byte{0x95, 0x1}, Extensions: []string{"SKR"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PHOTOSHOP_CUSTOM_SHAPE_CSH = FileSignature{ Description: "Photoshop Custom Shape", Header: []byte{0x63, 0x75, 0x73, 0x68, 0x0, 0x0, 0x0, 0x2}, Extensions: []string{"CSH"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PHOTOSHOP_IMAGE_PSD = FileSignature{ Description: "Photoshop image", Header: []byte{0x38, 0x42, 0x50, 0x53}, Extensions: []string{"PSD"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PICASA_MOVIE_PROJECT_FILE_MXF = FileSignature{ Description: "Picasa movie project file", Header: []byte{0x3c, 0x43, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x54, 0x69, 0x6d, 0x65, 0x6c, 0x69, 0x6e, 0x65, 0x3e}, Extensions: []string{"MXF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PKLITE_ARCHIVE_ZIP = FileSignature{ Description: "PKLITE archive", Header: []byte{0x50, 0x4b, 0x4c, 0x49, 0x54, 0x45}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 30, Trailer: []byte(nil), }
View Source
var SIG_PKSFX_SELF_EXTRACTING_ARCHIVE_ZIP = FileSignature{ Description: "PKSFX self-extracting archive", Header: []byte{0x50, 0x4b, 0x53, 0x70, 0x58}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 526, Trailer: []byte(nil), }
View Source
var SIG_PKZIP_ARCHIVE_1_ZIP = FileSignature{ Description: "PKZIP archive_1", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte{0x50, 0x4b, 0x0, 0x0, 0x0}, }
View Source
var SIG_PKZIP_ARCHIVE_2_ZIP = FileSignature{ Description: "PKZIP archive_2", Header: []byte{0x50, 0x4b, 0x5, 0x6}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PKZIP_ARCHIVE_3_ZIP = FileSignature{ Description: "PKZIP archive_3", Header: []byte{0x50, 0x4b, 0x7, 0x8}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PNG_IMAGE_PNG = FileSignature{ Description: "PNG image", Header: []byte{0x89, 0x50, 0x4e, 0x47, 0xd, 0xa, 0x1a, 0xa}, Extensions: []string{"PNG"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte{0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82}, }
View Source
var SIG_PORTABLE_GRAYMAP_GRAPHIC_PGM = FileSignature{ Description: "Portable Graymap Graphic", Header: []byte{0x50, 0x35, 0xa}, Extensions: []string{"PGM"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_POWERBASIC_DEBUGGER_SYMBOLS_PDB = FileSignature{ Description: "PowerBASIC Debugger Symbols", Header: []byte{0x73, 0x7a, 0x65, 0x7a}, Extensions: []string{"PDB"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_POWERISO_DIRECT_ACCESS_ARCHIVE_IMAGE_DAA = FileSignature{ Description: "PowerISO Direct-Access-Archive image", Header: []byte{0x44, 0x41, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"DAA"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PACKAGED_PRESENTATION_PPZ = FileSignature{ Description: "Powerpoint Packaged Presentation", Header: []byte{0x4d, 0x53, 0x43, 0x46}, Extensions: []string{"PPZ"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_1_PPT = FileSignature{ Description: "PowerPoint presentation subheader_1", Header: []byte{0x0, 0x6e, 0x1e, 0xf0}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_2_PPT = FileSignature{ Description: "PowerPoint presentation subheader_2", Header: []byte{0xf, 0x0, 0xe8, 0x3}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_3_PPT = FileSignature{ Description: "PowerPoint presentation subheader_3", Header: []byte{0xa0, 0x46, 0x1d, 0xf0}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_4_PPT = FileSignature{ Description: "PowerPoint presentation subheader_4", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0xe, 0x0, 0x0, 0x0}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_5_PPT = FileSignature{ Description: "PowerPoint presentation subheader_5", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x1c, 0x0, 0x0, 0x0}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_POWERPOINT_PRESENTATION_SUBHEADER_6_PPT = FileSignature{ Description: "PowerPoint presentation subheader_6", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x43, 0x0, 0x0, 0x0}, Extensions: []string{"PPT"}, Class: "Presentation", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_PSION_SERIES_3_DATABASE_DBF = FileSignature{ Description: "Psion Series 3 Database", Header: []byte{0x4f, 0x50, 0x4c, 0x44, 0x61, 0x74, 0x61, 0x62}, Extensions: []string{"DBF"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PUFFER_ASCII_ENCRYPTED_ARCHIVE_APUF = FileSignature{ Description: "Puffer ASCII encrypted archive", Header: []byte{0x42, 0x65, 0x67, 0x69, 0x6e, 0x20, 0x50, 0x75, 0x66, 0x66, 0x65, 0x72}, Extensions: []string{"APUF"}, Class: "Encryption", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_PUFFER_ENCRYPTED_ARCHIVE_PUF = FileSignature{ Description: "Puffer encrypted archive", Header: []byte{0x50, 0x55, 0x46, 0x58}, Extensions: []string{"PUF"}, Class: "Encryption", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QBASIC_SZDD_FILE = FileSignature{ Description: "QBASIC SZDD file", Header: []byte{0x53, 0x5a, 0x20, 0x88, 0xf0, 0x27, 0x33, 0xd1}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QCOW_DISK_IMAGE_QEMU = FileSignature{ Description: "Qcow Disk Image", Header: []byte{0x51, 0x46, 0x49}, Extensions: []string{"QEMU"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QIMAGE_FILTER_FLT = FileSignature{ Description: "Qimage filter", Header: []byte{0x76, 0x32, 0x30, 0x30, 0x33, 0x2e, 0x31, 0x30}, Extensions: []string{"FLT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUAKE_ARCHIVE_FILE_PAK = FileSignature{ Description: "Quake archive file", Header: []byte{0x50, 0x41, 0x43, 0x4b}, Extensions: []string{"PAK"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUARK_EXPRESS_INTEL_QXD = FileSignature{ Description: "Quark Express (Intel)", Header: []byte{0x0, 0x0, 0x49, 0x49, 0x58, 0x50, 0x52}, Extensions: []string{"QXD"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUARK_EXPRESS_MOTOROLA_QXD = FileSignature{ Description: "Quark Express (Motorola)", Header: []byte{0x0, 0x0, 0x4d, 0x4d, 0x58, 0x50, 0x52}, Extensions: []string{"QXD"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUATRO_PRO_FOR_WINDOWS_70_WB3 = FileSignature{ Description: "Quatro Pro for Windows 7.0", Header: []byte{0x3e, 0x0, 0x3, 0x0, 0xfe, 0xff, 0x9, 0x0, 0x6}, Extensions: []string{"WB3"}, Class: "Spreadsheet", HeaderOffset: 24, Trailer: []byte(nil), }
View Source
var SIG_QUATTROPRO_SPREADSHEET_WB2 = FileSignature{ Description: "QuattroPro spreadsheet", Header: []byte{0x0, 0x0, 0x2, 0x0}, Extensions: []string{"WB2"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKBOOKS_BACKUP_QBB = FileSignature{ Description: "QuickBooks backup", Header: []byte{0x45, 0x86, 0x0, 0x0, 0x6, 0x0}, Extensions: []string{"QBB"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKEN_DATA_FILE_ABD_QSD = FileSignature{ Description: "Quicken data file", Header: []byte{0x51, 0x57, 0x20, 0x56, 0x65, 0x72, 0x2e, 0x20}, Extensions: []string{"ABD", "QSD"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKEN_DATA_QDF = FileSignature{ Description: "Quicken data", Header: []byte{0xac, 0x9e, 0xbd, 0x8f, 0x0, 0x0}, Extensions: []string{"QDF"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKEN_DATA_QEL = FileSignature{ Description: "Quicken data", Header: []byte{0x51, 0x45, 0x4c, 0x20}, Extensions: []string{"QEL"}, Class: "Finance", HeaderOffset: 92, Trailer: []byte(nil), }
View Source
var SIG_QUICKEN_PRICE_HISTORY_QPH = FileSignature{ Description: "Quicken price history", Header: []byte{0x3, 0x0, 0x0, 0x0}, Extensions: []string{"QPH"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKEN_QUICKFINDER_INFORMATION_FILE_IDX = FileSignature{ Description: "Quicken QuickFinder Information File", Header: []byte{0x50, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0}, Extensions: []string{"IDX"}, Class: "Finance", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKREPORT_REPORT_QRP = FileSignature{ Description: "QuickReport Report", Header: []byte{0xff, 0xa, 0x0}, Extensions: []string{"QRP"}, Class: "Financial", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_1_MOV = FileSignature{ Description: "QuickTime movie_1", Header: []byte{0x6d, 0x6f, 0x6f, 0x76}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_2_MOV = FileSignature{ Description: "QuickTime movie_2", Header: []byte{0x66, 0x72, 0x65, 0x65}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_3_MOV = FileSignature{ Description: "QuickTime movie_3", Header: []byte{0x6d, 0x64, 0x61, 0x74}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_4_MOV = FileSignature{ Description: "QuickTime movie_4", Header: []byte{0x77, 0x69, 0x64, 0x65}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_5_MOV = FileSignature{ Description: "QuickTime movie_5", Header: []byte{0x70, 0x6e, 0x6f, 0x74}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_6_MOV = FileSignature{ Description: "QuickTime movie_6", Header: []byte{0x73, 0x6b, 0x69, 0x70}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_QUICKTIME_MOVIE_7_MOV = FileSignature{ Description: "QuickTime movie_7", Header: []byte{0x66, 0x74, 0x79, 0x70, 0x71, 0x74, 0x20, 0x20}, Extensions: []string{"MOV"}, Class: "Multimedia", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_RADIANCE_HIGH_DYNAMIC_RANGE_IMAGE_FILE_HDR = FileSignature{ Description: "Radiance High Dynamic Range image file", Header: []byte{0x23, 0x3f, 0x52, 0x41, 0x44, 0x49, 0x41, 0x4e}, Extensions: []string{"HDR"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_RAGTIME_DOCUMENT_RTD = FileSignature{ Description: "RagTime document", Header: []byte{0x43, 0x23, 0x2b, 0x44, 0xa4, 0x43, 0x4d, 0xa5}, Extensions: []string{"RTD"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REALAUDIO_FILE_RA = FileSignature{ Description: "RealAudio file", Header: []byte{0x2e, 0x52, 0x4d, 0x46, 0x0, 0x0, 0x0, 0x12}, Extensions: []string{"RA"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REALAUDIO_STREAMING_MEDIA_RA = FileSignature{ Description: "RealAudio streaming media", Header: []byte{0x2e, 0x72, 0x61, 0xfd, 0x0}, Extensions: []string{"RA"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REALMEDIA_METAFILE_RAM = FileSignature{ Description: "RealMedia metafile", Header: []byte{0x72, 0x74, 0x73, 0x70, 0x3a, 0x2f, 0x2f}, Extensions: []string{"RAM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REALMEDIA_STREAMING_MEDIA_RM_RMVB = FileSignature{ Description: "RealMedia streaming media", Header: []byte{0x2e, 0x52, 0x4d, 0x46}, Extensions: []string{"RM", "RMVB"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REALPLAYER_VIDEO_FILE_V11P_IVR = FileSignature{ Description: "RealPlayer video file (V11+)", Header: []byte{0x2e, 0x52, 0x45, 0x43}, Extensions: []string{"IVR"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REDHAT_PACKAGE_MANAGER_RPM = FileSignature{ Description: "RedHat Package Manager", Header: []byte{0xed, 0xab, 0xee, 0xdb}, Extensions: []string{"RPM"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_RELOCATABLE_OBJECT_CODE_OBJ = FileSignature{ Description: "Relocatable object code", Header: []byte{0x80}, Extensions: []string{"OBJ"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_RESOURCE_INTERCHANGE_FILE_FORMAT_AVI_CDA_QCP_RMI_WAV_WEBP = FileSignature{ Description: "Resource Interchange File Format", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"AVI", "CDA", "QCP", "RMI", "WAV", "WEBP"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_REVIT_PROJECT_FILE_RVT = FileSignature{ Description: "Revit Project file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"RVT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_RICH_TEXT_FORMAT_RTF = FileSignature{ Description: "Rich Text Format", Header: []byte{0x7b, 0x5c, 0x72, 0x74, 0x66, 0x31}, Extensions: []string{"RTF"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte{0x5c, 0x70, 0x61, 0x72, 0x20, 0x7d, 0x7d}, }
View Source
var SIG_RIFF_CD_AUDIO_CDA = FileSignature{ Description: "RIFF CD audio", Header: []byte{0x43, 0x44, 0x44, 0x41, 0x66, 0x6d, 0x74, 0x20}, Extensions: []string{"CDA"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RIFF_QUALCOMM_PUREVOICE_QCP = FileSignature{ Description: "RIFF Qualcomm PureVoice", Header: []byte{0x51, 0x4c, 0x43, 0x4d, 0x66, 0x6d, 0x74, 0x20}, Extensions: []string{"QCP"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RIFF_WEBP_WEBP = FileSignature{ Description: "RIFF WebP", Header: []byte{0x57, 0x45, 0x42, 0x50}, Extensions: []string{"WEBP"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RIFF_WINDOWS_AUDIO_AVI = FileSignature{ Description: "RIFF Windows Audio", Header: []byte{0x41, 0x56, 0x49, 0x20, 0x4c, 0x49, 0x53, 0x54}, Extensions: []string{"AVI"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RIFF_WINDOWS_AUDIO_WAV = FileSignature{ Description: "RIFF Windows Audio", Header: []byte{0x57, 0x41, 0x56, 0x45, 0x66, 0x6d, 0x74, 0x20}, Extensions: []string{"WAV"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RIFF_WINDOWS_MIDI_RMI = FileSignature{ Description: "RIFF Windows MIDI", Header: []byte{0x52, 0x4d, 0x49, 0x44, 0x64, 0x61, 0x74, 0x61}, Extensions: []string{"RMI"}, Class: "Multimedia", HeaderOffset: 8, Trailer: []byte(nil), }
View Source
var SIG_RUNTIME_SOFTWARE_DISK_IMAGE_DAT = FileSignature{ Description: "Runtime Software disk image", Header: []byte{0x1a, 0x52, 0x54, 0x53, 0x20, 0x43, 0x4f, 0x4d}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_R_SAVED_WORK_SPACE_RDATA = FileSignature{ Description: "R saved work space", Header: []byte{0x52, 0x44, 0x58, 0x32, 0xa}, Extensions: []string{"RDATA"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SAS_TRANSPORT_DATASET_XPT = FileSignature{ Description: "SAS Transport dataset", Header: []byte{0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x20, 0x52, 0x45, 0x43, 0x4f, 0x52, 0x44, 0x2a, 0x2a, 0x2a}, Extensions: []string{"XPT"}, Class: "Statistics", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SCREEN_SAVER_SCR = FileSignature{ Description: "Screen saver", Header: []byte{0x4d, 0x5a}, Extensions: []string{"SCR"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SHAREAZA_P2P_THUMBNAIL_DAT = FileSignature{ Description: "Shareaza (P2P) thumbnail", Header: []byte{0x52, 0x41, 0x5a, 0x41, 0x54, 0x44, 0x42, 0x31}, Extensions: []string{"DAT"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SHOCKWAVE_FLASH_FILE_SWF = FileSignature{ Description: "Shockwave Flash file", Header: []byte{0x43, 0x57, 0x53}, Extensions: []string{"SWF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SHOCKWAVE_FLASH_PLAYER_SWF = FileSignature{ Description: "Shockwave Flash player", Header: []byte{0x46, 0x57, 0x53}, Extensions: []string{"SWF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SHOW_PARTNER_GRAPHICS_FILE_GX2 = FileSignature{ Description: "Show Partner graphics file", Header: []byte{0x47, 0x58, 0x32}, Extensions: []string{"GX2"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SIBELIUS_MUSIC___SCORE_SIB = FileSignature{ Description: "Sibelius Music - Score", Header: []byte{0xf, 0x53, 0x49, 0x42, 0x45, 0x4c, 0x49, 0x55, 0x53}, Extensions: []string{"SIB"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SIETRONICS_CPI_XRD_DOCUMENT_CPI = FileSignature{ Description: "Sietronics CPI XRD document", Header: []byte{0x53, 0x49, 0x45, 0x54, 0x52, 0x4f, 0x4e, 0x49}, Extensions: []string{"CPI"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SILICON_GRAPHICS_RGB_BITMAP_RGB = FileSignature{ Description: "Silicon Graphics RGB Bitmap", Header: []byte{0x1, 0xda, 0x1, 0x1, 0x0, 0x3}, Extensions: []string{"RGB"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SKINCRAFTER_SKIN_SKF = FileSignature{ Description: "SkinCrafter skin", Header: []byte{0x7, 0x53, 0x4b, 0x46}, Extensions: []string{"SKF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SKYPE_AUDIO_COMPRESSION_SIL = FileSignature{ Description: "Skype audio compression", Header: []byte{0x23, 0x21, 0x53, 0x49, 0x4c, 0x4b, 0xa}, Extensions: []string{"SIL"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SKYPE_LOCALIZATION_DATA_FILE_MLS = FileSignature{ Description: "Skype localization data file", Header: []byte{0x4d, 0x4c, 0x53, 0x57}, Extensions: []string{"MLS"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SKYPE_USER_DATA_FILE_DBB = FileSignature{ Description: "Skype user data file", Header: []byte{0x6c, 0x33, 0x33, 0x6c}, Extensions: []string{"DBB"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SMARTDRAW_DRAWING_FILE_SDR = FileSignature{ Description: "SmartDraw Drawing file", Header: []byte{0x53, 0x4d, 0x41, 0x52, 0x54, 0x44, 0x52, 0x57}, Extensions: []string{"SDR"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SMPTE_DPX_BIG_ENDIAN_SDPX = FileSignature{ Description: "SMPTE DPX (big endian)", Header: []byte{0x53, 0x44, 0x50, 0x58}, Extensions: []string{"SDPX"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SMPTE_DPX_FILE_LITTLE_ENDIAN_DPX = FileSignature{ Description: "SMPTE DPX file (little endian)", Header: []byte{0x58, 0x50, 0x44, 0x53}, Extensions: []string{"DPX"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SMS_TEXT_SIM = FileSignature{ Description: "SMS text (SIM)", Header: []byte{0x6f, 0x3c}, Extensions: []string(nil), Class: "Mobile", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SONIC_FOUNDRY_ACID_MUSIC_FILE_AC = FileSignature{ Description: "Sonic Foundry Acid Music File", Header: []byte{0x72, 0x69, 0x66, 0x66}, Extensions: []string{"AC"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SONY_COMPRESSED_VOICE_FILE_CDR_DVF_MSV = FileSignature{ Description: "Sony Compressed Voice File", Header: []byte{0x4d, 0x53, 0x5f, 0x56, 0x4f, 0x49, 0x43, 0x45}, Extensions: []string{"CDR", "DVF", "MSV"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SPEEDTOUCH_ROUTER_FIRMWARE_BIN_BLI_RBI = FileSignature{ Description: "Speedtouch router firmware", Header: []byte{0x42, 0x4c, 0x49, 0x32, 0x32, 0x33}, Extensions: []string{"BIN", "BLI", "RBI"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SPRINT_MUSIC_STORE_AUDIO_KOZ = FileSignature{ Description: "Sprint Music Store audio", Header: []byte{0x49, 0x44, 0x33, 0x3, 0x0, 0x0, 0x0}, Extensions: []string{"KOZ"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SPSS_DATA_FILE_SAV = FileSignature{ Description: "SPSS Data file", Header: []byte{0x24, 0x46, 0x4c, 0x32, 0x40, 0x28, 0x23, 0x29}, Extensions: []string{"SAV"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SPSS_OUTPUT_FILE_SPO = FileSignature{ Description: "SPSS output file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"SPO"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SPSS_TEMPLATE_SCT = FileSignature{ Description: "SPSS template", Header: []byte{0x57, 0x4, 0x0, 0x0, 0x53, 0x50, 0x53, 0x53, 0x20, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74}, Extensions: []string{"SCT"}, Class: "Statistics", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SQLITE_DATABASE_FILE_DB = FileSignature{ Description: "SQLite database file", Header: []byte{0x53, 0x51, 0x4c, 0x69, 0x74, 0x65, 0x20, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x20, 0x33, 0x0}, Extensions: []string{"DB"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SQL_DATA_BASE_MDF = FileSignature{ Description: "SQL Data Base", Header: []byte{0x1, 0xf, 0x0, 0x0}, Extensions: []string{"MDF"}, Class: "Database", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STAROFFICE_SPREADSHEET_SXC = FileSignature{ Description: "StarOffice spreadsheet", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"SXC"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STEGANOS_VIRTUAL_SECURE_DRIVE_SLE = FileSignature{ Description: "Steganos virtual secure drive", Header: []byte{0x41, 0x43, 0x76}, Extensions: []string{"SLE"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STL_STEREOLITHOGRAPHY_FILE_STL = FileSignature{ Description: "STL (STereoLithography) file", Header: []byte{0x73, 0x6f, 0x6c, 0x69, 0x64}, Extensions: []string{"STL"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STORAGECRAFT_SHADOWNPROTECT_BACKUP_FILE_SPF = FileSignature{ Description: "StorageCraft ShadownProtect backup file", Header: []byte{0x53, 0x50, 0x46, 0x49, 0x0}, Extensions: []string{"SPF"}, Class: "Backup", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STUFFIT_ARCHIVE_SIT = FileSignature{ Description: "StuffIt archive", Header: []byte{0x53, 0x49, 0x54, 0x21, 0x0}, Extensions: []string{"SIT"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_STUFFIT_COMPRESSED_ARCHIVE_SIT = FileSignature{ Description: "StuffIt compressed archive", Header: []byte{0x53, 0x74, 0x75, 0x66, 0x66, 0x49, 0x74, 0x20}, Extensions: []string{"SIT"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SUPERCALC_WORKSHEET_CAL = FileSignature{ Description: "SuperCalc worksheet", Header: []byte{0x53, 0x75, 0x70, 0x65, 0x72, 0x43, 0x61, 0x6c}, Extensions: []string{"CAL"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SURFPLAN_KITE_PROJECT_FILE_SLE = FileSignature{ Description: "Surfplan kite project file", Header: []byte{0x3a, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e}, Extensions: []string{"SLE"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SYMANTEC_WISE_INSTALLER_LOG_LOG = FileSignature{ Description: "Symantec Wise Installer log", Header: []byte{0x2a, 0x2a, 0x2a, 0x20, 0x20, 0x49, 0x6e, 0x73}, Extensions: []string{"LOG"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SYMANTEX_GHOST_IMAGE_FILE_GHO_GHS = FileSignature{ Description: "Symantex Ghost image file", Header: []byte{0xfe, 0xef}, Extensions: []string{"GHO", "GHS"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_SZDD_FILE_FORMAT = FileSignature{ Description: "SZDD file format", Header: []byte{0x53, 0x5a, 0x44, 0x44, 0x88, 0xf0, 0x27, 0x33}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TAJIMA_EMBORIDERY_DST = FileSignature{ Description: "Tajima emboridery", Header: []byte{0x4c, 0x41, 0x3a}, Extensions: []string{"DST"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TAPE_ARCHIVE_TAR = FileSignature{ Description: "Tape Archive", Header: []byte{0x75, 0x73, 0x74, 0x61, 0x72}, Extensions: []string{"TAR"}, Class: "Compressed archive", HeaderOffset: 257, Trailer: []byte(nil), }
View Source
var SIG_TARGETEXPRESS_TARGET_FILE_MTE = FileSignature{ Description: "TargetExpress target file", Header: []byte{0x4d, 0x43, 0x57, 0x20, 0x54, 0x65, 0x63, 0x68, 0x6e, 0x6f, 0x67, 0x6f, 0x6c, 0x69, 0x65, 0x73}, Extensions: []string{"MTE"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TCPDUMP_CAPTURE_FILE = FileSignature{ Description: "Tcpdump capture file", Header: []byte{0x34, 0xcd, 0xb2, 0xa1}, Extensions: []string(nil), Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TCPDUMP_LIBPCAP_CAPTURE_FILE = FileSignature{ Description: "tcpdump (libpcap) capture file", Header: []byte{0xa1, 0xb2, 0xc3, 0xd4}, Extensions: []string(nil), Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_THE_BAT__MESSAGE_BASE_INDEX_TBI = FileSignature{ Description: "The Bat! Message Base Index", Header: []byte{0x1, 0x1, 0x47, 0x19, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, Extensions: []string{"TBI"}, Class: "Email", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_THUMBSDB_SUBHEADER_DB = FileSignature{ Description: "Thumbs.db subheader", Header: []byte{0xfd, 0xff, 0xff, 0xff}, Extensions: []string{"DB"}, Class: "Windows", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_THUNDERBIRD_MOZILLA_MAIL_SUMMARY_FILE_MSF = FileSignature{ Description: "Thunderbird-Mozilla Mail Summary File", Header: []byte{0x2f, 0x2f, 0x20, 0x3c, 0x21, 0x2d, 0x2d, 0x20, 0x3c, 0x6d, 0x64, 0x62, 0x3a, 0x6d, 0x6f, 0x72, 0x6b, 0x3a, 0x7a}, Extensions: []string{"MSF"}, Class: "E-mail", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TIFF_FILE_1_TIF_TIFF = FileSignature{ Description: "TIFF file_1", Header: []byte{0x49, 0x20, 0x49}, Extensions: []string{"TIF", "TIFF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TIFF_FILE_2_TIF_TIFF = FileSignature{ Description: "TIFF file_2", Header: []byte{0x49, 0x49, 0x2a, 0x0}, Extensions: []string{"TIF", "TIFF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TIFF_FILE_3_TIF_TIFF = FileSignature{ Description: "TIFF file_3", Header: []byte{0x4d, 0x4d, 0x0, 0x2a}, Extensions: []string{"TIF", "TIFF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TIFF_FILE_4_TIF_TIFF = FileSignature{ Description: "TIFF file_4", Header: []byte{0x4d, 0x4d, 0x0, 0x2b}, Extensions: []string{"TIF", "TIFF"}, Class: "Picture", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TOMTOM_TRAFFIC_DATA_DAT = FileSignature{ Description: "TomTom traffic data", Header: []byte{0x4e, 0x41, 0x56, 0x54, 0x52, 0x41, 0x46, 0x46}, Extensions: []string{"DAT"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TORRENT_FILE_TORRENT = FileSignature{ Description: "Torrent file", Header: []byte{0x64, 0x38, 0x3a, 0x61, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65}, Extensions: []string{"TORRENT"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TRUETYPE_FONT_FILE_TTF = FileSignature{ Description: "TrueType font file", Header: []byte{0x0, 0x1, 0x0, 0x0, 0x0}, Extensions: []string{"TTF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_TRUETYPE_FONT_TTF = FileSignature{ Description: "TrueType font", Header: []byte{0x74, 0x72, 0x75, 0x65, 0x0}, Extensions: []string{"TTF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UFA_COMPRESSED_ARCHIVE_UFA = FileSignature{ Description: "UFA compressed archive", Header: []byte{0x55, 0x46, 0x41, 0xc6, 0xd2, 0xc1}, Extensions: []string{"UFA"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UFO_CAPTURE_MAP_FILE_DAT = FileSignature{ Description: "UFO Capture map file", Header: []byte{0x55, 0x46, 0x4f, 0x4f, 0x72, 0x62, 0x69, 0x74}, Extensions: []string{"DAT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UNDERGROUND_AUDIO_AST = FileSignature{ Description: "Underground Audio", Header: []byte{0x53, 0x43, 0x48, 0x6c}, Extensions: []string{"AST"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UNICODE_EXTENSIONS_UCE = FileSignature{ Description: "Unicode extensions", Header: []byte{0x55, 0x43, 0x45, 0x58}, Extensions: []string{"UCE"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UNIX_ARCHIVER_AR_MS_PROGRAM_LIBRARY_COMMON_OBJECT_FILE_FORMAT_COFF_LIB = FileSignature{ Description: "Unix archiver (ar)-MS Program Library Common Object File Format (COFF)", Header: []byte{0x21, 0x3c, 0x61, 0x72, 0x63, 0x68, 0x3e, 0xa}, Extensions: []string{"LIB"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_USER_INTERFACE_LANGUAGE_XML = FileSignature{ Description: "User Interface Language", Header: []byte{0x3c, 0x3f, 0x78, 0x6d, 0x6c, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31, 0x2e, 0x30, 0x22, 0x3f, 0x3e}, Extensions: []string{"XML"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UTF_16_UCS_2_FILE = FileSignature{ Description: "UTF-16-UCS-2 file", Header: []byte{0xfe, 0xff}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UTF_32_UCS_2_FILE = FileSignature{ Description: "UTF-32-UCS-2 file", Header: []byte{0xff, 0xfe}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UTF_32_UCS_4_FILE = FileSignature{ Description: "UTF-32-UCS-4 file", Header: []byte{0xff, 0xfe, 0x0, 0x0}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UTF_8_FILE = FileSignature{ Description: "UTF-8 file", Header: []byte{0xef, 0xbb, 0xbf}, Extensions: []string(nil), Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_UUENCODED_BASE64_FILE_B64 = FileSignature{ Description: "UUencoded BASE64 file", Header: []byte{0x62, 0x65, 0x67, 0x69, 0x6e, 0x2d, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34}, Extensions: []string{"B64"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte{0xa, 0x3d, 0x3d, 0x3d, 0x3d, 0xa}, }
View Source
var SIG_UUENCODED_FILE = FileSignature{ Description: "UUencoded file", Header: []byte{0x62, 0x65, 0x67, 0x69, 0x6e}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VBSCRIPT_ENCODED_SCRIPT_VBE = FileSignature{ Description: "VBScript Encoded script", Header: []byte{0x23, 0x40, 0x7e, 0x5e}, Extensions: []string{"VBE"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VCARD_VCF = FileSignature{ Description: "vCard", Header: []byte{0x42, 0x45, 0x47, 0x49, 0x4e, 0x3a, 0x56, 0x43}, Extensions: []string{"VCF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VIDEOVCD_VCDIMAGER_FILE_VCD = FileSignature{ Description: "VideoVCD-VCDImager file", Header: []byte{0x45, 0x4e, 0x54, 0x52, 0x59, 0x56, 0x43, 0x44}, Extensions: []string{"VCD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VIDEO_CD_MPEG_MOVIE_DAT = FileSignature{ Description: "Video CD MPEG movie", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"DAT"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VIRTUAL_PC_HD_IMAGE_VHD = FileSignature{ Description: "Virtual PC HD image", Header: []byte{0x63, 0x6f, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x78}, Extensions: []string{"VHD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISIO_DISPLAYWRITE_4_TEXT_FILE_DW4 = FileSignature{ Description: "Visio-DisplayWrite 4 text file", Header: []byte{0x4f, 0x7b}, Extensions: []string{"DW4"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISIO_FILE_VSD = FileSignature{ Description: "Visio file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"VSD"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUALBASIC_APPLICATION_VBX = FileSignature{ Description: "VisualBASIC application", Header: []byte{0x4d, 0x5a}, Extensions: []string{"VBX"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_BASIC_USER_DEFINED_CONTROL_FILE_CTL = FileSignature{ Description: "Visual Basic User-defined Control file", Header: []byte{0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x20}, Extensions: []string{"CTL"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_CPP_WORKBENCH_INFO_FILE_VCW = FileSignature{ Description: "Visual C++ Workbench Info File", Header: []byte{0x5b, 0x4d, 0x53, 0x56, 0x43}, Extensions: []string{"VCW"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_C_PRECOMPILED_HEADER_PCH = FileSignature{ Description: "Visual C PreCompiled header", Header: []byte{0x56, 0x43, 0x50, 0x43, 0x48, 0x30}, Extensions: []string{"PCH"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_STUDIO_NET_FILE_SLN = FileSignature{ Description: "Visual Studio .NET file", Header: []byte{0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x56, 0x69, 0x73, 0x75, 0x61, 0x6c}, Extensions: []string{"SLN"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_STUDIO_SOLUTION_SUBHEADER_SUO = FileSignature{ Description: "Visual Studio Solution subheader", Header: []byte{0xfd, 0xff, 0xff, 0xff, 0x4}, Extensions: []string{"SUO"}, Class: "Programming", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_VISUAL_STUDIO_SOLUTION_USER_OPTIONS_FILE_SOU = FileSignature{ Description: "Visual Studio Solution User Options file", Header: []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, Extensions: []string{"SOU"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VLC_PLAYER_SKIN_FILE_VLT = FileSignature{ Description: "VLC Player Skin file", Header: []byte{0x1f, 0x8b, 0x8}, Extensions: []string{"VLT"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VMAPSOURCE_GPS_WAYPOINT_DATABASE_GDB = FileSignature{ Description: "VMapSource GPS Waypoint Database", Header: []byte{0x4d, 0x73, 0x52, 0x63, 0x66}, Extensions: []string{"GDB"}, Class: "Navigation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VMWARE_3_VIRTUAL_DISK_VMDK = FileSignature{ Description: "VMware 3 Virtual Disk", Header: []byte{0x43, 0x4f, 0x57, 0x44}, Extensions: []string{"VMDK"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VMWARE_4_VIRTUAL_DISK_DESCRIPTION_VMDK = FileSignature{ Description: "VMware 4 Virtual Disk description", Header: []byte{0x23, 0x20, 0x44, 0x69, 0x73, 0x6b, 0x20, 0x44}, Extensions: []string{"VMDK"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VMWARE_4_VIRTUAL_DISK_VMDK = FileSignature{ Description: "VMware 4 Virtual Disk", Header: []byte{0x4b, 0x44, 0x4d}, Extensions: []string{"VMDK"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VMWARE_BIOS_STATE_FILE_NVRAM = FileSignature{ Description: "VMware BIOS state file", Header: []byte{0x4d, 0x52, 0x56, 0x4e}, Extensions: []string{"NVRAM"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_VOCALTEC_VOIP_MEDIA_FILE_VMD = FileSignature{ Description: "VocalTec VoIP media file", Header: []byte{0x5b, 0x56, 0x4d, 0x44, 0x5d}, Extensions: []string{"VMD"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WALKMAN_MP3_FILE_DAT = FileSignature{ Description: "Walkman MP3 file", Header: []byte{0x57, 0x4d, 0x4d, 0x50}, Extensions: []string{"DAT"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WEBEX_ADVANCED_RECORDING_FORMAT_ARF = FileSignature{ Description: "Webex Advanced Recording Format", Header: []byte{0x1, 0x0, 0x2, 0x0}, Extensions: []string{"ARF"}, Class: "Video", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WEBM_VIDEO_FILE_WEBM = FileSignature{ Description: "WebM video file", Header: []byte{0x1a, 0x45, 0xdf, 0xa3}, Extensions: []string{"WEBM"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WHEREISIT_CATALOG_CTF = FileSignature{ Description: "WhereIsIt Catalog", Header: []byte{0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x20}, Extensions: []string{"CTF"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WII_GAMECUBE_THP = FileSignature{ Description: "Wii-GameCube", Header: []byte{0x54, 0x48, 0x50, 0x0}, Extensions: []string{"THP"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WII_IMAGES_CONTAINER_TPL = FileSignature{ Description: "Wii images container", Header: []byte{0x0, 0x20, 0xaf, 0x30}, Extensions: []string{"TPL"}, Class: "System", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WIN2000_XP_PRINTER_SPOOL_FILE_SHD = FileSignature{ Description: "Win2000-XP printer spool file", Header: []byte{0x67, 0x49, 0x0, 0x0}, Extensions: []string{"SHD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WIN95_PASSWORD_FILE_PWL = FileSignature{ Description: "Win95 password file", Header: []byte{0xb0, 0x4d, 0x46, 0x43}, Extensions: []string{"PWL"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WIN98_PASSWORD_FILE_PWL = FileSignature{ Description: "Win98 password file", Header: []byte{0xe3, 0x82, 0x85, 0x96}, Extensions: []string{"PWL"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WIN9X_PRINTER_SPOOL_FILE_SHD = FileSignature{ Description: "Win9x printer spool file", Header: []byte{0x4b, 0x49, 0x0, 0x0}, Extensions: []string{"SHD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WIN9X_REGISTRY_HIVE_DAT = FileSignature{ Description: "Win9x registry hive", Header: []byte{0x43, 0x52, 0x45, 0x47}, Extensions: []string{"DAT"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINAMP_PLAYLIST_PLS = FileSignature{ Description: "WinAmp Playlist", Header: []byte{0x5b, 0x70, 0x6c, 0x61, 0x79, 0x6c, 0x69, 0x73, 0x74, 0x5d}, Extensions: []string{"PLS"}, Class: "Audio", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_7_THUMBNAIL_2_DB = FileSignature{ Description: "Windows 7 thumbnail_2", Header: []byte{0x49, 0x4d, 0x4d, 0x4d, 0x15, 0x0, 0x0, 0x0}, Extensions: []string{"DB"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_7_THUMBNAIL_DB = FileSignature{ Description: "Windows 7 thumbnail", Header: []byte{0x43, 0x4d, 0x4d, 0x4d, 0x15, 0x0, 0x0, 0x0}, Extensions: []string{"DB"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_ANIMATED_CURSOR_ANI = FileSignature{ Description: "Windows animated cursor", Header: []byte{0x52, 0x49, 0x46, 0x46}, Extensions: []string{"ANI"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_APPLICATION_LOG_LGC_LGD = FileSignature{ Description: "Windows application log", Header: []byte{0x7b, 0xd, 0xa, 0x6f, 0x20}, Extensions: []string{"LGC", "LGD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_CALENDAR_CAL = FileSignature{ Description: "Windows calendar", Header: []byte{0xb5, 0xa2, 0xb0, 0xb3, 0xb3, 0xb0, 0xa5, 0xb5}, Extensions: []string{"CAL"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_CURSOR_CUR = FileSignature{ Description: "Windows cursor", Header: []byte{0x0, 0x0, 0x2, 0x0}, Extensions: []string{"CUR"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_DISK_IMAGE_TBI = FileSignature{ Description: "Windows Disk Image", Header: []byte{0x0, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0}, Extensions: []string{"TBI"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_DOS_EXECUTABLE_FILE_COM_DLL_DRV_EXE_PIF_QTS_QTX_SYS = FileSignature{ Description: "Windows-DOS executable file", Header: []byte{0x4d, 0x5a}, Extensions: []string{"COM", "DLL", "DRV", "EXE", "PIF", "QTS", "QTX", "SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_DUMP_FILE_DMP_HDMP = FileSignature{ Description: "Windows dump file", Header: []byte{0x4d, 0x44, 0x4d, 0x50, 0x93, 0xa7}, Extensions: []string{"DMP", "HDMP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_EVENT_VIEWER_FILE_EVT = FileSignature{ Description: "Windows Event Viewer file", Header: []byte{0x30, 0x0, 0x0, 0x0, 0x4c, 0x66, 0x4c, 0x65}, Extensions: []string{"EVT"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_EXECUTABLE_FILE_1_COM_SYS = FileSignature{ Description: "Windows executable file_1", Header: []byte{0xe8}, Extensions: []string{"COM", "SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_EXECUTABLE_FILE_2_COM_SYS = FileSignature{ Description: "Windows executable file_2", Header: []byte{0xe9}, Extensions: []string{"COM", "SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_EXECUTABLE_FILE_3_COM_SYS = FileSignature{ Description: "Windows executable file_3", Header: []byte{0xeb}, Extensions: []string{"COM", "SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_EXECUTABLE_SYS = FileSignature{ Description: "Windows executable", Header: []byte{0xff}, Extensions: []string{"SYS"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_GRAPHICS_METAFILE_WMF = FileSignature{ Description: "Windows graphics metafile", Header: []byte{0xd7, 0xcd, 0xc6, 0x9a}, Extensions: []string{"WMF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_HELP_FILE_1_HLP = FileSignature{ Description: "Windows Help file_1", Header: []byte{0x0, 0x0, 0xff, 0xff, 0xff, 0xff}, Extensions: []string{"HLP"}, Class: "Windows", HeaderOffset: 6, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_HELP_FILE_2_GID_HLP = FileSignature{ Description: "Windows Help file_2", Header: []byte{0x3f, 0x5f, 0x3, 0x0}, Extensions: []string{"GID", "HLP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_HELP_FILE_3_GID_HLP = FileSignature{ Description: "Windows help file_3", Header: []byte{0x4c, 0x4e, 0x2, 0x0}, Extensions: []string{"GID", "HLP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_ICON_PRINTER_SPOOL_FILE_ICO_SPL = FileSignature{ Description: "Windows icon|printer spool file", Header: []byte{0x0, 0x0, 0x1, 0x0}, Extensions: []string{"ICO", "SPL"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_INTERNATIONAL_CODE_PAGE_CPI = FileSignature{ Description: "Windows international code page", Header: []byte{0xff, 0x46, 0x4f, 0x4e, 0x54}, Extensions: []string{"CPI"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_MEDIA_AUDIO_VIDEO_FILE_ASF_WMA_WMV = FileSignature{ Description: "Windows Media Audio-Video File", Header: []byte{0x30, 0x26, 0xb2, 0x75, 0x8e, 0x66, 0xcf, 0x11}, Extensions: []string{"ASF", "WMA", "WMV"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_MEDIA_COMPRESSED_SKIN_FILE_WMZ = FileSignature{ Description: "Windows Media compressed skin file", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"WMZ"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_MEDIA_PLAYER_PLAYLIST_WPL = FileSignature{ Description: "Windows Media Player playlist", Header: []byte{0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x4d, 0x65, 0x64, 0x69, 0x61, 0x20, 0x50, 0x6c, 0x61, 0x79, 0x65, 0x72, 0x20, 0x2d, 0x2d, 0x20}, Extensions: []string{"WPL"}, Class: "Multimedia", HeaderOffset: 84, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_MEMORY_DUMP_DMP = FileSignature{ Description: "Windows memory dump", Header: []byte{0x50, 0x41, 0x47, 0x45, 0x44, 0x55}, Extensions: []string{"DMP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_PREFETCH_FILE_PF = FileSignature{ Description: "Windows prefetch file", Header: []byte{0x11, 0x0, 0x0, 0x0, 0x53, 0x43, 0x43, 0x41}, Extensions: []string{"PF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_PREFETCH_PF = FileSignature{ Description: "Windows prefetch", Header: []byte{0x53, 0x43, 0x43, 0x41}, Extensions: []string{"PF"}, Class: "Windows", HeaderOffset: 4, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_PROGRAM_MANAGER_GROUP_FILE_GRP = FileSignature{ Description: "Windows Program Manager group file", Header: []byte{0x50, 0x4d, 0x43, 0x43}, Extensions: []string{"GRP"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_REGISTRY_FILE_REG = FileSignature{ Description: "Windows Registry file", Header: []byte{0xff, 0xfe}, Extensions: []string{"REG"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_SCRIPT_COMPONENT_UTF_8_1_WSF = FileSignature{ Description: "Windows Script Component (UTF-8)_1", Header: []byte{0xef, 0xbb, 0xbf, 0x3c}, Extensions: []string{"WSF"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_SCRIPT_COMPONENT_UTF_8_2_WSC = FileSignature{ Description: "Windows Script Component (UTF-8)_2", Header: []byte{0xef, 0xbb, 0xbf, 0x3c, 0x3f}, Extensions: []string{"WSC"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_SCRIPT_COMPONENT_WSC = FileSignature{ Description: "Windows Script Component", Header: []byte{0x3c, 0x3f}, Extensions: []string{"WSC"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_SHORTCUT_FILE_LNK = FileSignature{ Description: "Windows shortcut file", Header: []byte{0x4c, 0x0, 0x0, 0x0, 0x1, 0x14, 0x2, 0x0}, Extensions: []string{"LNK"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_VIRTUAL_DEVICE_DRIVERS_VXD_386 = FileSignature{ Description: "Windows virtual device drivers", Header: []byte{0x4d, 0x5a}, Extensions: []string{"VXD", "386"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_VISTA_EVENT_LOG_EVTX = FileSignature{ Description: "Windows Vista event log", Header: []byte{0x45, 0x6c, 0x66, 0x46, 0x69, 0x6c, 0x65, 0x0}, Extensions: []string{"EVTX"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDOWS_VISUAL_STYLESHEET_MANIFEST = FileSignature{ Description: "Windows Visual Stylesheet", Header: []byte{0x3c, 0x3f, 0x78, 0x6d, 0x6c, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d}, Extensions: []string{"MANIFEST"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINDUMP_WINPCAP_CAPTURE_FILE = FileSignature{ Description: "WinDump (winpcap) capture file", Header: []byte{0xd4, 0xc3, 0xb2, 0xa1}, Extensions: []string(nil), Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINNT_NETMON_CAPTURE_FILE_CAP = FileSignature{ Description: "WinNT Netmon capture file", Header: []byte{0x52, 0x54, 0x53, 0x53}, Extensions: []string{"CAP"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINNT_PRINTER_SPOOL_FILE_SHD = FileSignature{ Description: "WinNT printer spool file", Header: []byte{0x66, 0x49, 0x0, 0x0}, Extensions: []string{"SHD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINNT_REGISTRY_FILE_DAT = FileSignature{ Description: "WinNT registry file", Header: []byte{0x72, 0x65, 0x67, 0x66}, Extensions: []string{"DAT"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINNT_REGISTRY_REGISTRY_UNDO_FILES_REG_SUD = FileSignature{ Description: "WinNT Registry-Registry Undo files", Header: []byte{0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54}, Extensions: []string{"REG", "SUD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINPHAROAH_CAPTURE_FILE_ETH = FileSignature{ Description: "WinPharoah capture file", Header: []byte{0x1a, 0x35, 0x1, 0x0}, Extensions: []string{"ETH"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINPHAROAH_FILTER_FILE_FTR = FileSignature{ Description: "WinPharoah filter file", Header: []byte{0xd2, 0xa, 0x0, 0x0}, Extensions: []string{"FTR"}, Class: "Network", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINRAR_COMPRESSED_ARCHIVE_RAR = FileSignature{ Description: "WinRAR compressed archive", Header: []byte{0x52, 0x61, 0x72, 0x21, 0x1a, 0x7, 0x0}, Extensions: []string{"RAR"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WINZIP_COMPRESSED_ARCHIVE_ZIP = FileSignature{ Description: "WinZip compressed archive", Header: []byte{0x57, 0x69, 0x6e, 0x5a, 0x69, 0x70}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 29152, Trailer: []byte(nil), }
View Source
var SIG_WIN_SERVER_2003_PRINTER_SPOOL_FILE_SHD = FileSignature{ Description: "Win Server 2003 printer spool file", Header: []byte{0x68, 0x49, 0x0, 0x0}, Extensions: []string{"SHD"}, Class: "Windows", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORDPERFECT_DICTIONARY_CBD = FileSignature{ Description: "WordPerfect dictionary", Header: []byte{0x43, 0x42, 0x46, 0x49, 0x4c, 0x45}, Extensions: []string{"CBD"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORDPERFECT_TEXT_AND_GRAPHICS_WP_WPD_WPG_WPP_WP5_WP6 = FileSignature{ Description: "WordPerfect text and graphics", Header: []byte{0xff, 0x57, 0x50, 0x43}, Extensions: []string{"WP", "WPD", "WPG", "WPP", "WP5", "WP6"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORDPERFECT_TEXT_WPF = FileSignature{ Description: "WordPerfect text", Header: []byte{0x81, 0xcd, 0xab}, Extensions: []string{"WPF"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORDSTAR_FOR_WINDOWS_FILE_WS2 = FileSignature{ Description: "WordStar for Windows file", Header: []byte{0x57, 0x53, 0x32, 0x30, 0x30, 0x30}, Extensions: []string{"WS2"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORDSTAR_VERSION_50_60_DOCUMENT_WS = FileSignature{ Description: "WordStar Version 5.0-6.0 document", Header: []byte{0x1d, 0x7d}, Extensions: []string{"WS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORD_20_FILE_DOC = FileSignature{ Description: "Word 2.0 file", Header: []byte{0xdb, 0xa5, 0x2d, 0x0}, Extensions: []string{"DOC"}, Class: "Word processing", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_WORD_DOCUMENT_SUBHEADER_DOC = FileSignature{ Description: "Word document subheader", Header: []byte{0xec, 0xa5, 0xc1, 0x0}, Extensions: []string{"DOC"}, Class: "Word processing suite", HeaderOffset: 512, Trailer: []byte(nil), }
View Source
var SIG_WORKS_FOR_WINDOWS_SPREADSHEET_WKS = FileSignature{ Description: "Works for Windows spreadsheet", Header: []byte{0xff, 0x0, 0x2, 0x0, 0x4, 0x4, 0x5, 0x54}, Extensions: []string{"WKS"}, Class: "Spreadsheet", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_XML_PAPER_SPECIFICATION_FILE_XPS = FileSignature{ Description: "XML paper specification file", Header: []byte{0x50, 0x4b, 0x3, 0x4}, Extensions: []string{"XPS"}, Class: "Word processing suite", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_XPCOM_LIBRARIES_XPT = FileSignature{ Description: "XPCOM libraries", Header: []byte{0x58, 0x50, 0x43, 0x4f, 0x4d, 0xa, 0x54, 0x79}, Extensions: []string{"XPT"}, Class: "Programming", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_XZ_ARCHIVE_XZ = FileSignature{ Description: "XZ archive", Header: []byte{0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x0}, Extensions: []string{"XZ"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_YAMAHA_PIANO_PCS = FileSignature{ Description: "Yamaha Piano", Header: []byte{0x4d, 0x54, 0x68, 0x64}, Extensions: []string{"PCS"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_YAMAHA_SYNTHETIC_MUSIC_MOBILE_APPLICATION_FORMAT_MMF = FileSignature{ Description: "Yamaha Synthetic music Mobile Application Format", Header: []byte{0x4d, 0x4d, 0x4d, 0x44, 0x0, 0x0}, Extensions: []string{"MMF"}, Class: "Multimedia", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZISOFS_COMPRESSED_FILE = FileSignature{ Description: "zisofs compressed file", Header: []byte{0x37, 0xe4, 0x53, 0x96, 0xc9, 0xdb, 0xd6, 0x7}, Extensions: []string(nil), Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZLOCK_PRO_ENCRYPTED_ZIP_ZIP = FileSignature{ Description: "ZLock Pro encrypted ZIP", Header: []byte{0x50, 0x4b, 0x3, 0x4, 0x14, 0x0, 0x1, 0x0}, Extensions: []string{"ZIP"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZONEALAM_DATA_FILE_ZAP = FileSignature{ Description: "ZoneAlam data file", Header: []byte{0x4d, 0x5a, 0x90, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff}, Extensions: []string{"ZAP"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZOOMBROWSER_IMAGE_INDEX_INFO = FileSignature{ Description: "ZoomBrowser Image Index", Header: []byte{0x7a, 0x62, 0x65, 0x78}, Extensions: []string{"INFO"}, Class: "Miscellaneous", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZOO_COMPRESSED_ARCHIVE_ZOO = FileSignature{ Description: "ZOO compressed archive", Header: []byte{0x5a, 0x4f, 0x4f, 0x20}, Extensions: []string{"ZOO"}, Class: "Compressed archive", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZSOFT_PAINTBRUSH_FILE_1_PCX = FileSignature{ Description: "ZSOFT Paintbrush file_1", Header: []byte{0xa, 0x2, 0x1, 0x1}, Extensions: []string{"PCX"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZSOFT_PAINTBRUSH_FILE_2_PCX = FileSignature{ Description: "ZSOFT Paintbrush file_2", Header: []byte{0xa, 0x3, 0x1, 0x1}, Extensions: []string{"PCX"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
View Source
var SIG_ZSOFT_PAINTBRUSH_FILE_3_PCX = FileSignature{ Description: "ZSOFT Paintbrush file_3", Header: []byte{0xa, 0x5, 0x1, 0x1}, Extensions: []string{"PCX"}, Class: "Presentation", HeaderOffset: 0, Trailer: []byte(nil), }
Functions ¶
func ValidateSignature ¶
func ValidateSignature(s FileSignature, f io.ReaderAt) (bool, error)
Types ¶
type FileSignature ¶
type FileSignature struct { Description string Header []byte HeaderOffset int64 HeaderLength uint64 Trailer []byte Extensions []string Class string }
FileSignature represents information about a file's signature. Each comma separated value from Gary Kessler's FileSig (RAW)
func GetAllSignatures ¶
func GetAllSignatures() []FileSignature
func GetSignaturesByExtension ¶
func GetSignaturesByExtension(ext string) []FileSignature
func NewFileSignature ¶
func NewFileSignature(desc, header, exts, class, offset, trailer string) (*FileSignature, error)
NewFileSignature creates a new FileSignature object from string representation
func (FileSignature) ExtensionsGoString ¶
func (fs FileSignature) ExtensionsGoString() string
func (FileSignature) HeaderGoString ¶
func (fs FileSignature) HeaderGoString() string
func (FileSignature) SigName ¶
func (fs FileSignature) SigName() string
func (FileSignature) TrailerGoString ¶
func (fs FileSignature) TrailerGoString() string
Click to show internal directories.
Click to hide internal directories.