Lines Matching +full:en +full:- +full:us
2 #------------------------------------------------------------------------------
23 # v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT
25 # and partly verified by `undbx --verbosity 4 Posteingang.dbx`
27 # skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file si…
29 #!:mime application/octet-stream
30 #!:mime application/vnd.ms-outlook
31 !:mime application/x-ms-dbx
43 # CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder
44 # 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline
68 #!:mime application/octet-stream
69 #!:mime application/vnd.ms-outlook
70 !:mime application/x-ms-nickfile
72 # nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is us…
82 # value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string
90 # UTF-16
99 # https://web.archive.org/web/20101125060849/https://computer.forensikblog.de/en/2008/02/64bit_mag…
103 # https://gitlab.com/qemu-project/qemu/-/blob/master/include/qemu/win_dump_defs.h
105 # and verified by like Windows Kit `Dumpchk.exe 043022-18703-01.dmp`
106 # and partly by NirSoft `BlueScreenView.exe 043022-18703-01.dmp`
111 #!:mime application/octet-stream
112 !:mime application/x-ms-dmp
113 # like: Mini111013-01.dmp
171 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dmp-64.trid.xml113o
175 #!:mime application/octet-stream
176 !:mime application/x-ms-dmp
177 # like: c:\Windows\Minidump\020322-18890-01.dmp c:\Windows\MEMORY.DMP
236 # https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
254 # https://computer.forensikblog.de/en/2007/05/some_magic.html
259 #!:mime application/octet-stream
260 !:mime application/x-ms-evtx
263 >0x24 ulelong =0x00030001 Vista-8.1 Event Log
264 >0x24 ulelong !0x00030001 10-11 Event Log, version
280 # verified by `tracerpt.EXE Wifi.etl -of EVTX`
281 # and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml`
284 # look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl
287 >>0 use trace-etl
289 0 name trace-etl
291 #!:mime application/x-ms-etl
298 >>&-2 lestring16 x "%s"
302 # URL: http://en.wikipedia.org/wiki/System_Deployment_Image
306 !:mime application/x-ms-sdi
307 #!:mime application/octet-stream
340 # BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
341 >>0x400 string >\0 \b, type %-3.8s
342 # 0~non-filesystem 7~NTFS 6~BIGFAT
352 >>0x440 string >\0 \b, type %-3.8s
361 >>0x480 string >\0 \b, type %-3.8s
372 >>0 use bootstat-dat
374 0 name bootstat-dat
376 #!:mime application/octet-stream
377 !:mime application/x-ms-dat
391 >(0x4.l-1) ubyte x
392 >>&0 use bootstat-entry
394 >(0x4.l-1) ubyte x
396 >>&(&0x18.l-1) ubyte x
397 >>>&0 use bootstat-entry
399 # >(0x4.l-1) ubyte x
400 # >>&(&0x18.l-1) ubyte x
401 # >>>&(&0x18.l-1) ubyte x
402 # >>>>&0 use bootstat-entry
404 0 name bootstat-entry
434 >>0x2A uleshort x \b-%u
436 >>0x2C uleshort x \b-%u
447 # pathname of boot application, as null-terminated Unicode string; typically
452 # URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting
470 # URL: https://en.wikipedia.org/wiki/WinHelp
476 0 name help-ver-date
505 !:mime application/x-winhelp
510 !:mime application/x-winhelp
519 >>>>>&0 use help-ver-date
523 >>>>>>>&0 use help-ver-date
526 >>>>>>>>>&0 use help-ver-date
529 >>>>>>>>>>>&0 use help-ver-date
532 >>>>>>>>>>>>>&0 use help-ver-date
535 >>>>>>>>>>>>>>>&0 use help-ver-date
539 >>>>>>>>>>>>>>>>>&0 use help-ver-date
546 # remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
548 !:mime application/x-winhelp
567 #>>(4.l+15) string >\0 \b, Structure_"%-.16s"
589 >>&0 use cnt-name
595 >>>&0 use cnt-name
598 0 name cnt-name
609 !:mime application/x-winhelp-fts
616 # URL: https://en.wikipedia.org/wiki/HyperACCESS
621 >14 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
622 #!:mime application/octet-stream
623 !:mime application/x-ms-ht
632 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/
633 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lnk-shortcut.trid.xml
634 # https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%…
635 # Note: called "Windows Shortcut" by TrID, "Microsoft Windows Shortcut" by DROID via PUID x-fmt/42…
638 # HeaderSize + LinkCLSID 00021401-0000-0000-C000-000000000046
640 !:mime application/x-ms-shortcut
654 # IsUnicode; If set then StringData section contains Unicode-encoded strings
662 # TargetAnsi (260 bytes); NULL-terminated path to environment variable encoded with system default …
664 # TargetUnicode (520 bytes): optional NULL-terminated path to same environment variable Unicode enc…
667 # RunInSeparateProcess; run in a separate virtual machine when launching a 16-bit application; no e…
675 # DarwinDataAnsi (260 bytes); NULL-terminated application identifier encoded with system default co…
677 # DarwinDataUnicode (520 bytes); NULL-terminated application identifier Unicode encoded
685 # TargetAnsi (260 bytes); NULL-terminated path to environment icon variable encoded with system def…
687 # TargetUnicode (520 bytes); optional NULL-terminated path to same icon environment variable Unicod…
701 # MachineID (16 bytes); a NULL-terminated NetBIOS name encoded with system default code page of the…
720 # https://learn.microsoft.com/en-us/dotnet/desktop/winforms/controls/known-folder-guids-for-file-di…
722 # ProgramFiles 905E63B6-C1BF-494E-B29C-65B732D3D21A
723 # ProgramFilesX86 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E
736 >24 lelong&1 1 \b, Read-Only
790 >>78 use lnk-item
793 >>>(78.s+78) use lnk-item
795 >>>&(&-2.s-2) uleshort >0
796 >>>>&-2 use lnk-item
798 >>>>&(&-2.s-2) uleshort >0
799 >>>>>&-2 use lnk-item
804 >>>76 use lnk-info
808 #>>>>(76.s+78) use lnk-info
811 >>>>>&-8 ubelong x
815 0 name lnk-item
823 # like: "26EE0668-A00A-44D7-9371-BEB064C98683" Control Panel
824 # "20D04FE0-3AEA-1069-A2D8-08002B30309D" My Computer
825 # "871C5380-42A0-1069-A2EA-08002B30309D" Internet Explorer
833 0 name lnk-info
861 # https://en.wikipedia.org/wiki/Personal_Storage_Table
862 # Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf
866 # skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-26…
869 #!:mime application/octet-stream
871 !:mime application/vnd.ms-outlook
872 # dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit
878 # "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75
880 #!:mime application/x-ms-pab
883 # http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml
885 # by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode
889 #!:mime application/x-ms-pst
894 #!:mime application/x-ms-ost
912 # ANSI 32-bit variant Outlook 1997-2002
932 # UNICODE 64-bit variant Outlook 2003-2007
946 # dwCRC; 32-bit CRC of the of the previous 516 bytes
970 # URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
974 # Windows 3-9X variant
979 !:mime text/x-ms-regedit
986 !:mime text/x-ms-regedit
988 # Windows 2K UTF-16 variant
990 >0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above)
992 #>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above)
993 !:mime text/x-ms-regedit
996 # URL: https://en.wikipedia.org/wiki/Wine_(software)
997 # Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
1003 !:mime text/x-wine-extension-reg
1012 >0 use ini-file
1018 # ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant
1021 >>0 use ini-file
1024 >0 use ini-file
1026 0 name ini-file
1029 # https://en.wikipedia.org/wiki/Autorun.inf
1030 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
1044 !:mime application/x-setupscript
1046 # https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
1047 # version strings ASCII coded case-independent for Windows setup information script file
1049 !:mime application/x-setupscript
1050 #!:mime application/x-wine-extension-inf
1054 !:mime application/x-setupscript
1057 # https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
1058 # .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
1060 !:mime application/x-wine-extension-ini
1064 !:mime application/x-wine-extension-ini
1067 !:mime application/x-wine-extension-ini
1069 # https://technet.microsoft.com/en-us/library/cc722567.aspx
1072 !:mime application/x-wine-extension-ini
1074 # https://en.wikipedia.org/wiki/SYSTEM.INI
1076 !:mime application/x-wine-extension-ini
1080 !:mime application/x-wine-extension-ini
1082 # https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
1084 !:mime application/x-wine-extension-ini
1086 # https://en.wikipedia.org/wiki/CONFIG.SYS
1087 >>&0 regex/c \^menu] MS-DOS CONFIG.SYS
1094 >>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS
1108 !:mime text/x-ms-cpx
1112 # URL: https://en.wikipedia.org/wiki/File_Explorer
1113 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml
1117 !:mime text/x-ms-scf
1124 # URL: http://en.wikipedia.org/wiki/VIA_Technologies
1125 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml
1129 !:mime text/x-via-scf
1133 # URL: https://en.wikipedia.org/wiki/InstallShield
1134 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml
1138 !:mime text/x-installshield-lid
1142 # URL: https://www.file-extensions.org/tag-file-extension
1148 !:mime text/x-ms-tag
1151 # URL: https://en.wikipedia.org/wiki/Flatpak
1160 # URL: https://en.wikipedia.org/wiki/CloneCD
1161 # Reference: https://en.wikipedia.org/wiki/CloneCD_Control_File
1162 # http://mark0.net/download/triddefs_xml.7z/defs/c/cdimage-clonecd-cue.trid.xml
1164 >>&0 string CloneCD] CloneCD CD-image Description
1166 !:mime text/x-ccd
1175 !:mime application/x-setupscript
1179 # Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cfp-cdrtfe.trid.xml
1181 !:mime text/x-cfp
1183 # https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
1188 >>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s
1190 #!:mime application/x-setupscript
1191 !:mime application/x-wine-extension-ini
1198 # UTF-16 BOM
1200 # look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml)
1203 >>0 use windows-adm
1206 # UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
1210 # keyword without 1st letter which is maybe up-/down-case
1212 !:mime application/x-setupscript
1216 !:mime application/x-setupscript
1220 !:mime application/x-setupscript
1223 # netnwcli.inf start with ;---[ NetNWCli.INX ]
1229 !:mime application/x-setupscript
1234 # URL: https://en.wikipedia.org/wiki/Administrative_Template
1240 >>0 use windows-adm
1242 >>0 use windows-adm
1244 0 name windows-adm Windows Policy Administrative Template
1245 !:mime text/x-ms-adm
1247 # UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml)
1250 # look for UTF-16 encoded CarriageReturn LineFeed
1253 # no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml)
1260 >>>>>&-2 string x "%s"
1263 >>>>&-2 string x "%s"
1268 # Reference: http://en.verysource.com/code/10350344_1/inf.h.html
1270 # check for valid major and minor versions: 101h - 303h
1272 # GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp
1279 # skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some
1280 # Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low sect…
1285 !:mime application/x-pnf
1288 # 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11
1292 >>4 ulelong&0x00000001 !0x00000001 95-98)
1294 >0 uleshort =0x0301 (Windows Vista-8.1)
1296 >0 uleshort =0x0303 (Windows 10-11)
1336 # FILETIME is number of 100-nanosecond intervals since 1 January 1601
1376 # https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0…
1407 # language string like: de-DE en-US
1413 # URL: https://en.wikipedia.org/wiki/NTBackup
1423 # BIT4-BIT15, BIT18-BIT31 of block attributes are unused
1425 #!:mime application/x-ntbackup
1509 # URL: https://en.wikipedia.org/wiki/PaintShop_Pro
1510 # Reference: https://www.cryer.co.uk/file-types/p/pal.htm
1513 0 string JASC-PAL\r\n PaintShop Pro color palette
1522 # URL: https://en.wikipedia.org/wiki/Innosetup
1525 # Note: created by like "InnoSetup self-extracting archive" inside ./msdos
1529 !:mime application/x-innosetup
1532 # " 64-bit" variant
1537 # GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
1539 >>0x40 string x %-.38s
1560 >>0x1db lestring16 x \b, %-.9s
1564 >>>&0 lestring16 x \b\%-.9s
1567 >>>>&0 lestring16 x \b, %-.42s
1575 !:mime application/x-innosetup-msg
1592 >>>0x1c search/2 (u) (UTF-16),
1600 # URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
1603 # fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
1604 # Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
1606 >0 use wim-archive
1609 >0 use wim-archive
1610 0 name wim-archive
1613 !:mime application/x-ms-wim
1627 # solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
1647 # 1-based index of the bootable image of the WIM, or 0 if no image is bootable
1662 #define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h
1695 # URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer
1700 #!:mime application/octet-stream
1701 !:mime application/x-ms-mig
1708 >>>&-1 indirect x
1716 >>&20 lestring16 x \b, 1st %-s
1719 # https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK)
1727 # URL: https://en.wikipedia.org/wiki/Performance_Monitor
1732 #!:mime application/octet-stream
1733 # https://www.thoughtco.com/mime-types-by-content-type-3469108
1734 # https://filext.com/file-extension/PAM
1735 !:mime application/x-perfmon
1736 #!:mime application/x-ms-pma
1742 # URL: https://en.wikipedia.org/wiki/InstallShield
1746 #!:mime application/octet-stream
1747 !:mime application/x-installshield-ins
1753 # copyright text like: "Stirling Technologies, Inc. (c) 1990-1994"
1754 # "InstallSHIELD Software Corporation (c) 1990-1997"
1759 >>&-4 leshort x #%u
1760 >>&-2 pstring/h x %s
1785 # URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/rdp…
1790 !:mime text/x-ms-rdp
1796 0 guid 7B5C52E4-D88C-4DA7-AEB1-5378D02996D3 Microsoft OneNote
1799 0 guid 43FF2FA1-EFD9-4C76-9EE2-10EA5722765F Microsoft OneNote Revision Store File
1820 # URL: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/registry-policy-f…