1 2#------------------------------------------------------------------------------ 3# $File: ole2compounddocs,v 1.29 2024/06/18 17:07:48 christos Exp $ 4# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 5# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 6# Additional tests for OLE 2 Compound Documents should be under this recipe. 7# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 8 90 string \320\317\021\340\241\261\032\341 10# https://digital-preservation.github.io/droid/ 11# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 12>0x1A ushort !0xABAB OLE 2 Compound Document 13#>0x1C uleshort x \b, endnian %#4.4x 14# big endian not tested 15>>0x1C ubeshort =0xfffe \b, big-endian 16>>>546 string jbjb : Microsoft Word Document 17!:mime application/msword 18!:apple MSWDWDBN 19!:ext doc 20# Byte Order 0xFFFE means little-endian found in real world applications 21#>>0x1C uleshort =0xfffe \b, little-endian 22>>0x1C uleshort =0xfffe 23# From: Joerg Jenderek 24# Major Version 3 or 4 25>>>0x1A uleshort x \b, v%u 26# Minor Version 32h=50 3Bh=59 3Eh=62 27>>>0x18 uleshort x \b.%u 28# SecID of first sector of the directory stream is often 1 but high like 3144h 29>>>48 ulelong x \b, SecID %#x 30# Sector Shift Exponent in short-stream container stream: 6~64 bytes 31>>>32 uleshort !6 \b, exponent of short stream %u 32# total number of sectors used for the FAT 33>>>44 ulelong >1 \b, %u FAT sectors 34# SecID of first sector of the short-sector allocation table (Mini FAT) 35# or -2 (End Of ChainSecID) if not extant 36>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x 37# total number of sectors used for the short-sector allocation table 38>>>64 ulelong !1 \b, %u Mini FAT sector 39# plural s 40>>>>64 ulelong >1 \bs 41# SecID of first sector of the master sector allocation table (DIFAT) 42# or -2 (End Of Chain SecID) if no additional sectors used 43>>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x 44# total number of sectors used for the master sector allocation table (DIFAT) 45>>>72 ulelong >0 \b, %u DIFAT sectors 46# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 47#>>>76 ubequad x \b, DIFAT=%#16.16llx 48#>>>84 ubequad x \b%16.16llx... 49# pointer to root entry only works with standard configuration for SecID ~< 800h 50# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 51# "ORLEN Factbook 2017.xls" XnView_metadata.doc 52# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 53>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 54# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 55>>>0x1E uleshort 0xc \b, blocksize 4096 56# jump to one block (4096 bytes per block) before root storage block 57>>>>(48.l*4096) ubyte x 58>>>>>&4095 use ole2-directory 59#>>>0x1E uleshort 9 \b, blocksize 512 60>>>0x1E uleshort 9 61# jump to one block (512 bytes per block) before root storage block 62# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 63>>>>(48.l*512) ubyte x 64>>>>>&511 use ole2-directory 65# check directory entry structure and display types by GUID 660 name ole2-directory 67# directory entry name like "Root Entry" 68#>0 lestring16 x \b, 1st %.10s 69# type of the entry; 5~Root storage 70#>66 ubyte x \b, type %x 71# node colour of the entry: 00H ~ Red 01H ~ Black 72#>67 ubyte x \b, color %x 73# the DirIDs of the child nodes. Should both be -1 in the root storage entry 74#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 75# NEXT lines for DEBUGGING 76# second directory entry name like VisioDocument Control000 77#>128 lestring16 x \b, 2nd %.20s 78# third directory entry like WordDocument 79#>256 lestring16 x \b, 3rd %.20s 80# forth 81#>384 lestring16 x \b, 4th %.10s 82# 5th 83#>512 lestring16 x \b, 5th %.10s 84# 6th 85#>640 lestring16 x \b, 6th %.10s 86# 7th 87#>768 lestring16 x \b, 7th %.10s 88# https://wikileaks.org/ciav7p1/cms/page_13762814.html 89# https://m.blog.naver.com/superman4u/40047693679 90# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 91# https://toolslick.com/conversion/data/guid 92#>80 ubequad !0 \b, clsid %#16.16llx 93#>>88 ubequad x \b%16.16llx 94# test for "Root Entry" inside directory by type 5 value 95>66 ubyte 5 96# look for CLSID GUID 0 97>>88 ubequad 0x0 98>>>80 ubequad 0x0 99# - Microstation V8 DGN files (www.bentley.com) 100# URL: https://en.wikipedia.org/wiki/MicroStation 101# Last update on 10/23/2006 by Lester Hightower 102# 07/24/2019 by Joerg Jenderek 103# Second directory entry name like Dgn~H Dgn~S 104>>>>128 lestring16 Dgn~ : Microstation V8 CAD 105#!:mime application/x-ole-storage 106!:mime application/x-bentley-dgn 107# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 108!:ext dgn 109# 110# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 111# Second directory entry name PerfectOffice_ 112>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 113!:mime application/vnd.wordperfect 114# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 115!:apple ????WPC7 116!:ext mst/wpd/wpg 117# 118# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 119# Second directory entry name MatOST_ 120>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 121!:mime application/vnd.ms-works 122!:apple ????AWWP 123!:ext wps 124# 125# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 126# 3rd directory entry name WksSSWorkBook 127>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 128!:mime application/vnd.ms-works 129!:apple ????AWSS 130!:ext xlr 131# 132# URL: http://fileformats.archiveteam.org/wiki/XLS 133# what is the difference to {00020820-0000-0000-c000-000000000046} ? 134# Second directory entry name Workbook 135>>>>128 lestring16 Workbook 136>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 137!:mime application/vnd.ms-excel 138# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 139!:apple ????XLS9 140!:ext xls 141# 142# URL: http://fileformats.archiveteam.org/wiki/PPT 143# Second directory entry name Object1 Object12 Object35 144>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 145!:mime application/vnd.ms-powerpoint 146# https://www.macdisk.com/macsigen.php 147!:apple ????PPT3 148!:ext ppt 149# 150# URL: https://www.msoutlook.info/question/164 151# Second directory entry name __CollDataStm 152>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 153#!:mime application/vnd.ms-outlook 154!:mime application/x-ms-srs 155# %APPDATA%\Microsoft\Outlook\Outlook.srs 156!:ext srs 157# 158# URL: https://www.file-extensions.org/cag-file-extension 159# Second directory entry name Category 160>>>>128 lestring16 Category : Microsoft Clip Art Gallery 161#!:mime application/x-ole-storage 162!:mime application/x-ms-cag 163!:apple MScgCGdb 164!:ext cag/ 165# 166# URL: https://www.filesuffix.com/de/extension/rra 167# 3rd directory entry name StrIndex_StringTable 168>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 169#!:mime application/x-ole-storage 170!:mime application/x-ms-rra 171!:ext rra 172# 173# URL: https://www.forensicswiki.org/wiki/Jump_Lists 174# 3rd directory entry name DestList 175>>>>256 lestring16 DestList : Windows jump list 176#!:mime application/x-ole-storage 177!:mime application/x-ms-jumplist 178# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 179!:ext automaticDestinations-ms 180# 181# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 182# Second directory entry name 256_ 183>>>>128 lestring16 256_ : Windows thumbnail database 256 184#!:mime application/x-ole-storage 185!:mime application/x-ms-thumbnail 186# Thumbs.db 187!:ext db 188>>>>128 lestring16 96_ : Windows thumbnail database 96 189!:mime application/x-ms-thumbnail 190!:ext db 191# 3rd directory entry name Catalog_ 192>>>>256 lestring16 Catalog : Windows thumbnail database 193!:mime application/x-ms-thumbnail 194!:ext db 195# 196# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 197# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 198# Second directory entry name Control000 199>>>>128 lestring16 Control000 : Microsoft old Systeminfo 200#!:mime application/x-ole-storage 201!:mime application/x-ms-info 202!:ext nfo 203# 204# From: Joerg Jenderek 205# URL: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns 206# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml 207# Note: older versions til 13 about middle 2021 handled by ./windows 208# called "Sysinternals Autoruns data (v14)" by TrID 209# second, third and fourth directory entry name like Header Items 0 210>>>>128 lestring16 Header : Microsoft sysinternals AutoRuns data, version 14 211#!:mime application/x-ole-storage 212!:mime application/x-ms-arn 213# like: MyHOSTNAME.arn 214!:ext arn 215# 216# From: Joerg Jenderek 217# URL: https://en.wikipedia.org/wiki/Microsoft_Access 218# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml 219# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 220# Note: only version foo tested and called "Microsoft Access Wizard template" by TrID 221# Fourth directory entry name TemplateID 222>>>>384 lestring16 TemplateID : Microsoft Access wizard template 223# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation 224#!:mime application/x-ole-storage 225#!:mime application/vnd.ms-office 226#!:mime application/vnd.ms-access 227#!:mime application/msaccess 228!:mime application/x-ms-mdz 229# http://extension.nirsoft.net/mdz 230!:ext mdz 231# 232# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 233# Second directory entry name Thumbnail 234>>>>128 lestring16 Thumbnail : Corel PrintHouse image 235#!:mime application/x-ole-storage 236!:mime application/x-corel-cph 237!:ext cph 238# 3rd directory entry name Thumbnail 239>>>>256 lestring16 Thumbnail : Corel PrintHouse image 240!:mime application/x-corel-cph 241!:ext cph 242# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 243# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album 244# third directory entry name _INFO_ 245>>>>256 lestring16 _INFO_ : Corel Gallery 246# second directory entry name _ITEM_ or _DATA_ 247# later directory entry names: _ALBUM_ _THUMBNAIL_ 248#!:mime application/x-ole-storage 249!:mime application/x-corel-gal 250!:ext gal 251# 252# From: Joerg Jenderek 253# URL: https://archive.org/details/iPhoto-Plus-4 254# https://filext.com/file-extension/TPL 255# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml 256# Note: found in Template sub directory in program directory of software iPhoto Plus version 4 257# second, third and fourth directory entry name like TplHeader TplMainImage TplPreview 258>>>>128 lestring16 TplHeader : Ulead iPhoto Template 259#!:mime application/x-ole-storage 260!:mime image/x-ulead-tpl 261# https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template 262!:ext tpl 263# 264# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 265# https://www.hancom.com/etc/hwpDownload.do 266# Note: "HWP Document File" signature found in FileHeader 267# Hangul Word Processor WORDIAN, 2002 and later is using HWP 5.0 format. 268# Second directory entry name FileHeader hint for Thinkfree Office document 269>>>>128 lestring16 FileHeader : Hancom HWP (Hangul Word Processor) file, version 5.0 270#!:mime application/haansofthwp 271!:mime application/x-hwp 272# https://example-files.online-convert.com/document/hwp/example.hwp 273!:ext hwp 274# 275# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 276# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 277>>>>128 lestring16 dd2 : StarOffice Gallery view 278#!:mime application/x-ole-storage 279!:mime application/x-star-sdv 280!:ext sdv 281# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 282# second directory entry name Current User 283>>>>128 lestring16 Current\ User : SoftMaker 284# third directory entry name SMNativeObjData 285>>>>>256 lestring16 SMNativeObjData 286# 5th directory entry name PowerPoint 287>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 288!:mime application/vnd.ms-powerpoint 289!:ext ppt/pps/pot 290# 4th directory entry name PowerPoint 291>>>>>384 lestring16 PowerPoint Presentations or template 292# http://extension.nirsoft.net/prv 293!:mime application/vnd.softmaker.presentations 294!:ext prd/prv 295# third directory entry name like Current User 296>>>>256 lestring16 Current\ User : SoftMaker 297# 5th directory entry name PowerPoint 298>>>>>512 lestring16 PowerPoint Presentations or template 299# http://extension.nirsoft.net/prd 300!:mime application/vnd.softmaker.presentations 301!:ext prd/prv 302# 2nd directory entry name Pictures 303>>>>>>128 lestring16 Pictures with pictures 304# 305# URL: http://fileformats.archiveteam.org/wiki/PageMaker 306# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p 307# pagemaker-generic.trid.xml 308# pagemaker-pm6.trid.xml 309# pagemaker-pm65.trid.xml 310# pmd-pm7.trid.xml 311# From: Joerg Jenderek 312# Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors 313# verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6` 314# Second directory entry name PageMaker 315>>>>128 lestring16 PageMaker : 316# look for magic of "old" PageMaker like in 02TEMPLT.T65 317>>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99 318# GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version! 319#>>>>>>&0 use PageMaker 320# THIS WORKS PARTLY! 321>>>>>>&0 indirect x 322# 323# URL: http://fileformats.archiveteam.org/wiki/Easy_CD_Creator 324# From: Joerg Jenderek 325# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml 326# Note: called "Easy CD Creator Layout" by TrID 327# "newer" version 4 contain a clsid 328# Second directory entry name Contents 329>>>>128 lestring16 Contents : Easy CD Creator 2 Layout 330# contains also 3 strings SesnDescriptor CD_PLUS 0090 331#!:mime application/x-ole-storage 332!:mime application/x-corel-cl2 333!:ext cl2 334# remaining null clsid 335>>>>128 default x 336>>>>>0 use ole2-unknown 337# look for CLSID where "second" part is 0 338>>>80 ubequad !0x0 339# 340# Summary: Family Tree Maker 341# From: Joerg Jenderek 342# URL: http://fileformats.archiveteam.org/wiki/Family_Tree_Maker 343# https://en.wikipedia.org/wiki/Family_Tree_Maker 344# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/ftw.trid.xml 345# Note called "Family Tree Maker Family Tree" by TrID and 346# "FamilyTree Maker Database" with version "1-4" by DROID via PUID fmt/1352 347# tested only with version 2.0 348# verified by Michal Mutl Structured Storage Viewer `SSView.exe my.ftw` 349# newer versions are SQLite based and handled by ./sql 350# directory names like: IND.DB AUX.DB GENERAL.DB NAME.NDX BIRTH.NDX EXTRA.DB 351>>>>80 ubequad 0x5702000000000000 : Family Tree Maker Windows database, version 1-4 352# look for "File Format (C) Copyright 1993 Banner Blue Software Inc. - All Rights Reserved" in GENERAL.DB 353#>>>>>0 search/0x5460c/s F\0i\0l\0e\0\040\0F\0o\0r\0m\0a\0t\0\040\0(\0C\0)\0 \b, VERSION 354# GRR: jump to version value like 2 does not work! 355#>>>>>>&-8 ubyte x %u 356#!:mime application/x-ole-storage 357!:mime application/x-fmt 358# FBK is used for backup of FTW 359!:ext ftw/fbk 360# 361>>>>80 default x 362>>>>>0 use ole2-unknown 363# look for known clsid GUID 364# - Visio documents 365# URL: http://fileformats.archiveteam.org/wiki/Visio 366# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 367>>88 ubequad 0xc000000000000046 368>>>80 ubequad 0x131a020000000000 : Microsoft Visio 2000-2002 Document, stencil or template 369!:mime application/vnd.visio 370# VSD~Drawing VSS~Stencil VST~Template 371!:ext vsd/vss/vst 372>>>80 ubequad 0x141a020000000000 : Microsoft Visio 2003-2010 Document, stencil or template 373!:mime application/vnd.visio 374!:ext vsd/vss/vst 375# 376# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 377# https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation 378# Update: Joerg Jenderek 379# Windows Installer Package *.MSI or validation module *.CUB 380>>>80 ubequad 0x84100c0000000000 : Microsoft Windows Installer Package or validation module 381!:mime application/x-msi 382#!:mime application/x-ms-win-installer 383# https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices 384# cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub 385#!:mime application/x-ms-cub 386!:ext msi/cub 387# From: Joerg Jenderek 388# URL: http://en.wikipedia.org/wiki/Windows_Installer 389# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mst.trid.xml 390# called "Windows SDK Setup Transform script" by TrID 391>>>80 ubequad 0x82100c0000000000 : Microsoft Windows Installer transform script 392#!:mime application/x-ole-storage 393!:mime application/x-ms-mst 394!:ext mst 395>>>80 ubequad 0x86100c0000000000 : Microsoft Windows Installer Patch 396# ?? 397!:mime application/x-wine-extension-msp 398#!:mime application/x-ms-msp 399!:ext msp 400# 401# URL: http://fileformats.archiveteam.org/wiki/DOC 402>>>80 ubequad 0x0009020000000000 : Microsoft Word 6-95 document or template 403!:mime application/msword 404# for template MSWDW8TN 405!:apple MSWDWDBN 406!:ext doc/dot 407>>>80 ubequad 0x0609020000000000 : Microsoft Word 97-2003 document or template 408!:mime application/msword 409!:apple MSWDWDBN 410# dot for template; no extension on Macintosh 411!:ext doc/dot/ 412# 413# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 414>>>80 ubequad 0x0213020000000000 : Microsoft Works 3-4 document or template 415!:mime application/vnd.ms-works 416!:apple ????AWWP 417# ps for template https://filext.com/file-extension/PS bps for backup 418!:ext wps/ps/bps 419# 420# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 421>>>80 ubequad 0x0313020000000000 : Microsoft Works 3-4 database or template 422!:mime application/vnd.ms-works-db 423# https://www.macdisk.com/macsigen.php 424!:apple ????AWDB 425# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 426!:ext wdb/db/bdb 427# 428# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 429>>>80 ubequad 0x1008020000000000 : Microsoft Excel 5-95 worksheet, addin or template 430!:mime application/vnd.ms-excel 431# https://www.macdisk.com/macsigen.php 432!:apple ????XLS5 433# worksheet/addin/template/no extension on Macintosh 434!:ext xls/xla/xlt/ 435# 436>>>80 ubequad 0x2008020000000000 : Microsoft Excel 97-2003 437!:mime application/vnd.ms-excel 438# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 439!:apple ????XLS9 440# 3rd directory entry name 441>>>>256 lestring16 _VBA_PROJECT_CUR addin 442!:ext xla/ 443# 4th directory entry name 444>>>>384 lestring16 _VBA_PROJECT_CUR addin 445!:ext xla 446#!:ext xla/ 447>>>>256 default x worksheet or template 448!:ext xls/xlt 449#!:ext xls/xlt/ 450# 451# URL: http://fileformats.archiveteam.org/wiki/OLE2 452>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 item 453#>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 Message 454#!:mime application/vnd.ms-outlook 455!:mime application/x-ms-msg 456!:ext msg 457# URL: https://wiki.fileformat.com/email/oft/ 458>>>80 ubequad 0x46f0060000000000 : Microsoft Outlook 97-2003 item template 459#!:mime application/vnd.ms-outlook 460!:mime application/x-ms-oft 461!:ext oft 462# 463# URL: http://fileformats.archiveteam.org/wiki/PPT 464>>>80 ubequad 0x5148040000000000 : Microsoft PowerPoint 4.0 presentation 465!:mime application/vnd.ms-powerpoint 466# https://www.macdisk.com/macsigen.php 467!:apple ????PPT3 468!:ext ppt 469# Summary: "newer" Greenstreet Art drawing 470# From: Joerg Jenderek 471# URL: http://fileformats.archiveteam.org/wiki/GST_ART 472# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml 473# Note: called like "Greenstreet Art drawing" by TrID 474# Note: CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16 475# verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART` 476>>>80 ubequad 0x602c020000000000 : Greenstreet Art drawing 477#!:mime application/x-ole-storage 478!:mime image/x-greenstreet-art 479!:ext art 480>>>80 default x 481>>>>0 use ole2-unknown 482#?? 483# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 484>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 485# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 486>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 487!:mime application/vnd.ms-works 488!:apple ????AWWP 489!:ext wps 490# 491# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 492>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 493!:mime application/vnd.ms-works-db 494!:apple ????AWDB 495!:ext wdb/bdb 496#?? 497>>88 ubequad 0xa40700c04fb932ba : Microsoft 498# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 499>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 500!:mime application/vnd.ms-works 501!:apple ????AWWP 502!:ext wps 503# From: Joerg Jenderek 504# URL: https://en.wikipedia.org/wiki/Microsoft_Works 505# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 506# Note: probably version 6 and 7 507# organize pictures like JPFG images in streams __cf1 with names like 508# 001.JPG, 002.JPG ... in streams __fname 509>>88 ubequad 0xa1c800c04f612452 : Microsoft 510>>>80 ubequad 0xc0c7266eb98cd311 Works portfolio 511# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed 512#!:mime application/x-ole-storage 513# https://www.iana.org/assignments/media-types/application/vnd.ms-works 514!:mime application/vnd.ms-works 515# https://extension.nirsoft.net/wsb 516# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb 517!:ext wsb 518# 519# Update: Joerg Jenderek 520# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 521# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pub.trid.xml 522# Note: called like "Microsoft Publisher document" by TrID 523# "version" string MSPublisher.2 inside CompObj stream 524>>88 ubequad 0x00c0000000000046 : Microsoft 525>>>80 ubequad 0x0012020000000000 Publisher 95 (2.0) 526!:mime application/vnd.ms-publisher 527!:ext pub 528>>>80 ubequad 0x0112020000000000 Publisher 97-2013 (3.0-11.0) 529!:mime application/vnd.ms-publisher 530!:ext pub 531# 532# URL: http://fileformats.archiveteam.org/wiki/PPT 533#?? 534>>88 ubequad 0xa90300aa00510ea3 : Microsoft 535>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 536!:mime application/vnd.ms-powerpoint 537# https://www.macdisk.com/macsigen.php 538!:apple ????PPT3 539!:ext ppt/pot 540#?? 541>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 542>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 543!:mime application/vnd.ms-powerpoint 544!:apple ????PPT3 545# /autostart/template 546!:ext ppt/pps/pot 547# From: Joerg Jenderek 548# URL: https://www.file-extensions.org/ppa-file-extension 549# https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231 550# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 551>>88 ubequad 0x871800aa0060263b : Microsoft 552# only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org) 553>>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard 554# second, third and fourth directory entry name like VBA PROJECT PROJECTwm 555# http://extension.nirsoft.net/pwz 556!:mime application/vnd.ms-powerpoint 557# like: BSHPPT97.PPA "AutoContent Wizard.pwz" 558!:ext ppa/pwz 559# 560# From: Joerg Jenderek 561# URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document) 562# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml 563# Note: called "Microsoft At Work Fax document" by TrID 564>>88 ubequad 0xb29400dd010f2bf9 : Microsoft 565>>>80 ubequad 0x801cb0023de01a10 At Work fax Document 566#!:mime application/x-ole-storage 567!:mime image/x-ms-awd 568!:ext awd 569# 570# URL: https://en.wikipedia.org/wiki/Microsoft_Project 571#?? 572>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 573>>>80 ubequad 0x3a8fb774c8c8d111 Project 574!:mime application/vnd.ms-project 575!:ext mpp 576# From: Joerg Jenderek 577# URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder 578# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml 579# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 580# Note: only version 8 tested and called "Office Binder Document" by TrID and 581# "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240 582>>88 ubequad 0xb21c00aa004ba90b : Microsoft 583>>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard 584# second directory entry name like Binder 585# https://www.file-extensions.org/obd-file-extension 586#!:mime application/vnd.ms-binder 587!:mime application/x-msbinder 588# obt for template; obz for Microsoft Office Binder wizard 589!:ext obd/obt/obz 590# 591# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 592# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 593# https://github.com/OneWingedShark/WordPerfect/ 594# blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm 595# From: Joerg Jenderek 596# Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd 597# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN, 598# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors 599>>88 ubequad 0x19370000929679cd : WordPerfect 7 600>>>80 ubequad 0xff739851ad2d2002 Document 601!:mime application/vnd.wordperfect 602#!:apple ????WPC? 603# https://fossies.org/linux/wp2latex/test/ole6.wpd 604!:ext wpd 605#>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE 606# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end 607#>>>>>&0 indirect x \b; contains 608# GRR: the above expression does not work correctly 609# 610# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 611#??? 612>>88 ubequad 0x99ae04021c007002 : WordPerfect 613>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 614!:mime application/x-corelpresentations 615#!:mime application/x-shw-viewer 616#!:mime image/x-presentations 617!:ext shw 618# 619# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 620>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 621#!:mime application/x-wpg 622#!:mime image/x-wordperfect-graphics 623!:mime image/x-wpg 624# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 625!:apple ????WPC9 626!:ext wpg 627# 628# From: Joerg Jenderek 629# URL: http://fileformats.archiveteam.org/wiki/CorelCAD 630# https://en.wikipedia.org/wiki/CorelCAD 631# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccd-corelcad.trid.xml 632# Note: called "CorelCAD Drawing" by TrID and CorelCAD 633# directory entry names like Contents ViewInfo CustomViewDescriptions LayerInfo 634>>88 ubequad 0xbe26db67235e2689 : Corel 635>>>80 ubequad 0x20f414de1cacce11 \bCAD Drawing or Template 636#!:mime application/x-ole-storage 637!:mime application/x-corel-cad 638# CCT for CorelCAD Template 639!:ext ccd/cct 640# 641# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 642>>88 ubequad 0x996104021c007002 : StarOffice 643>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 644# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 645!:mime application/x-starwriter 646!:ext sdw/vor 647# 648>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 649!:mime application/x-starcalc 650!:ext sdc/vor 651# 652>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 653!:mime application/x-starimpress 654#!:mime application/x-stardraw 655# sda ?? 656!:ext sdd/sda/vor 657#?? 658>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 659>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 660!:mime application/x-starcalc 661!:ext sdc/vor 662# 663>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 664!:mime application/vnd.stardivision.cal 665!:ext sdc/vor 666# 667>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 668!:mime application/x-starimpress 669!:ext sdd/vor 670#?? 671>>88 ubequad 0xb12a04021c007002 : StarOffice 672>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 673!:mime application/x-starmath 674!:ext smf 675#?? 676>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 677>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 678!:mime application/x-starchart 679!:ext sds 680#?? 681>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 682>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 683!:mime application/x-starwriter 684!:ext sdw/vor 685#?? 686>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 687>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 688!:mime application/x-starmath 689!:ext smf 690# 691>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 692!:mime application/x-starchart 693!:ext sds 694#?? 695>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 696>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 697!:mime application/x-starwriter-global 698!:ext sgl 699#?? 700>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 701>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 702!:mime application/vnd.stardivision.math 703!:ext smf 704# 705>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 706!:mime application/vnd.stardivision.draw 707!:ext sda/vor 708# 709>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 710!:mime application/vnd.stardivision.impress 711# sda is used for what? 712!:ext sdd/vor/sda 713# 714>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 715!:mime application/vnd.stardivision.chart 716!:ext sds 717# ?? 718>>88 ubequad 0xaab4006097da561a : StarOffice 719>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 720!:mime application/vnd.stardivision.writer 721!:ext sdw/vor 722# 723>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 724!:mime application/vnd.stardivision.writer-global 725!:ext sgl 726#?? 727# URL: http://fileformats.archiveteam.org/wiki/FlashPix 728>>88 ubequad 0x855300aa00a1f95b : Kodak 729>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 730!:mime image/vnd.fpx 731!:apple ????FPix 732!:ext fpx 733# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 734>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 735>>>80 ubequad 0x9174088a6452d411 document or template 736!:mime application/vnd.softmaker.planmaker 737# pmv for template https://www.file-extensions.org/pmv-file-extension 738!:ext pmd/pmv 739# URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max) 740# https://en.wikipedia.org/wiki/Autodesk_3ds_Max 741# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 742# Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and 743# "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max` 744# applies only to "newer" versions (about 2008-2020) 745>>88 ubequad 0x9fed04143144cc1e : Autodesk 746>>>80 ubequad 0x7b8cdd1cc081a045 3ds Max 747#!:mime application/x-ole-storage 748!:mime model/x-autodesk-max 749# like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max 750!:ext max 751# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978 752#!:ext max/chr 753# From: Joerg Jenderek 754# URL: http://fileformats.archiveteam.org/wiki/IPT 755# https://en.wikipedia.org/wiki/Autodesk_Inventor 756# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ipt.trid.xml 757# Note: called "Autodesk Inventor Part" by TrID 758# second, third, fifth and seventh directory entry name like RSeStorage RSeEmbeddings RefdFiles RSeDb 759>>88 ubequad 0x93c37e0706000000 : Autodesk 760>>>80 ubequad 0x90b4294db249d011 Inventor Part 761#!:mime application/x-ole-storage 762!:mime model/x-autodesk-ipt 763!:ext ipt 764# From: Joerg Jenderek 765# URL: http://fileformats.archiveteam.org/wiki/Easy_CD_Creator 766# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml 767# Note: called "Easy CD Creator Layout" by TrID, 768# "Easy CD Creator 4" by CREATR32.exe and "Easy CD Creator Document" on Windows 769# verified by Michal Mutl Structured Storage Viewer `SSView.exe MY_CD3.cl4` 770# verified partly by libolecf-utils `olecfinfo -v MY_CD4.cl4` 771# created by Adaptec Easy CD Creator 4.02b 772# "older" version 2 contain no clsid 773>>88 ubequad 0x893f00802964b632 : Easy 774>>>80 ubequad 0x0293c3a90a77d111 CD Creator 4 Layout 775#!:mime application/x-ole-storage 776!:mime application/x-corel-cl4 777!:ext cl4 778# maybe also suffix cl3 779#!:ext cl3/cl4 780# remaining non null clsid 781>>88 default x 782>>>0 use ole2-unknown 783# display information about directory for not detected CDF files 7840 name ole2-unknown 785>80 ubequad x : UNKNOWN 786# https://reposcope.com/mimetype/application/x-ole-storage 787!:mime application/x-ole-storage 788# according to file version 5.41 with -e soft option 789#!:mime application/CDFV2 790#!:ext ??? 791>80 ubequad !0 \b, clsid %#16.16llx 792>>88 ubequad x \b%16.16llx 793# converted hexadecimal format to standard GUUID notation 794>>80 guid x {%s} 795# second directory entry name like VisioDocument Control000 796>128 lestring16 x with names %.20s 797# third directory entry like WordDocument Preview.dib 798>256 lestring16 x %.20s 799# forth like \005SummaryInformation 800>384 lestring16 x %.25s 801# 5th 802>512 lestring16 x %.10s 803# 6th 804>640 lestring16 x %.10s 805# 7th 806>768 lestring16 x %.10s 807
