1b6cee71dSXin LI 2b6cee71dSXin LI#------------------------------------------------------------------------------ 3*43a5ec4eSXin LI# $File: ole2compounddocs,v 1.12 2021/09/04 16:00:38 christos Exp $ 4b6cee71dSXin LI# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 558a0f0d0SEitan Adler# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 6b6cee71dSXin LI# Additional tests for OLE 2 Compound Documents should be under this recipe. 7d38c30c0SXin LI# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 8b6cee71dSXin LI 9d38c30c0SXin LI0 string \320\317\021\340\241\261\032\341 10d38c30c0SXin LI# https://digital-preservation.github.io/droid/ 11d38c30c0SXin LI# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 12d38c30c0SXin LI>0x1A ushort !0xABAB OLE 2 Compound Document 13*43a5ec4eSXin LI#>0x1C uleshort x \b, endnian %#4.4x 14d38c30c0SXin LI# big endian not tested 15d38c30c0SXin LI>>0x1C ubeshort =0xfffe \b, big-endian 16d38c30c0SXin LI>>>546 string jbjb : Microsoft Word Document 1758a0f0d0SEitan Adler!:mime application/msword 1858a0f0d0SEitan Adler!:apple MSWDWDBN 1958a0f0d0SEitan Adler!:ext doc 20d38c30c0SXin LI# Byte Order 0xFFFE means little-endian found in real world applications 21d38c30c0SXin LI#>>0x1C uleshort =0xfffe \b, little-endian 22d38c30c0SXin LI>>0x1C uleshort =0xfffe 23d38c30c0SXin LI# From: Joerg Jenderek 24d38c30c0SXin LI# Major Version 3 or 4 25d38c30c0SXin LI>>>0x1A uleshort x \b, v%u 26d38c30c0SXin LI# Minor Version 32h=50 3Bh=59 3Eh=62 27d38c30c0SXin LI>>>0x18 uleshort x \b.%u 28d38c30c0SXin LI# SecID of first sector of the directory stream is often 1 but high like 3144h 29*43a5ec4eSXin LI>>>48 ulelong x \b, SecID %#x 302726a701SXin LI# Sector Shift Exponent in short-stream container stream: 6~64 bytes 312726a701SXin LI>>>32 uleshort !6 \b, exponent of short stream %u 322726a701SXin LI# total number of sectors used for the FAT 332726a701SXin LI>>>44 ulelong >1 \b, %u FAT sectors 342726a701SXin LI# SecID of first sector of the short-sector allocation table (Mini FAT) 352726a701SXin LI# or -2 (End Of ChainSecID) if not extant 36*43a5ec4eSXin LI>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x 372726a701SXin LI# total number of sectors used for the short-sector allocation table 382726a701SXin LI>>>64 ulelong !1 \b, %u Mini FAT sector 392726a701SXin LI# plural s 402726a701SXin LI>>>>64 ulelong >1 \bs 412726a701SXin LI# SecID of first sector of the master sector allocation table (DIFAT) 422726a701SXin LI# or -2 (End Of Chain SecID) if no additional sectors used 43*43a5ec4eSXin LI>>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x 442726a701SXin LI# total number of sectors used for the master sector allocation table (DIFAT) 452726a701SXin LI>>>72 ulelong >0 \b, %u DIFAT sectors 462726a701SXin LI# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 47*43a5ec4eSXin LI#>>>76 ubequad x \b, DIFAT=%#16.16llx 482726a701SXin LI#>>>84 ubequad x \b%16.16llx... 49d38c30c0SXin LI# pointer to root entry only works with standard configuration for SecID ~< 800h 50d38c30c0SXin LI# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 51d38c30c0SXin LI# "ORLEN Factbook 2017.xls" XnView_metadata.doc 52d38c30c0SXin LI# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 53d38c30c0SXin LI>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 54d38c30c0SXin LI# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 55d38c30c0SXin LI>>>0x1E uleshort 0xc \b, blocksize 4096 56d38c30c0SXin LI# jump to one block (4096 bytes per block) before root storage block 57d38c30c0SXin LI>>>>(48.l*4096) ubyte x 58d38c30c0SXin LI>>>>>&4095 use ole2-directory 59d38c30c0SXin LI#>>>0x1E uleshort 9 \b, blocksize 512 60d38c30c0SXin LI>>>0x1E uleshort 9 61d38c30c0SXin LI# jump to one block (512 bytes per block) before root storage block 62d38c30c0SXin LI# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 63d38c30c0SXin LI>>>>(48.l*512) ubyte x 64d38c30c0SXin LI>>>>>&511 use ole2-directory 65d38c30c0SXin LI# check directory entry structure and display types by GUID 66d38c30c0SXin LI0 name ole2-directory 67d38c30c0SXin LI# directory entry name like "Root Entry" 68d38c30c0SXin LI#>0 lestring16 x \b, 1st %.10s 69d38c30c0SXin LI# type of the entry; 5~Root storage 70d38c30c0SXin LI#>66 ubyte x \b, type %x 71d38c30c0SXin LI# node colour of the entry: 00H ~ Red 01H ~ Black 72d38c30c0SXin LI#>67 ubyte x \b, color %x 732726a701SXin LI# the DirIDs of the child nodes. Should both be -1 in the root storage entry 74d38c30c0SXin LI#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 75d38c30c0SXin LI# second directory entry name like VisioDocument Control000 76d38c30c0SXin LI#>128 lestring16 x \b, 2nd %.20s 77d38c30c0SXin LI# third directory entry like WordDocument 78d38c30c0SXin LI#>256 lestring16 x \b, 3rd %.20s 79d38c30c0SXin LI# forth 80d38c30c0SXin LI#>384 lestring16 x \b, 4th %.10s 81d38c30c0SXin LI# 5th 82d38c30c0SXin LI#>512 lestring16 x \b, 5th %.10s 83d38c30c0SXin LI# 6th 84d38c30c0SXin LI#>640 lestring16 x \b, 6th %.10s 85d38c30c0SXin LI# 7th 86d38c30c0SXin LI#>768 lestring16 x \b, 7th %.10s 87d38c30c0SXin LI# https://wikileaks.org/ciav7p1/cms/page_13762814.html 88d38c30c0SXin LI# https://m.blog.naver.com/superman4u/40047693679 89d38c30c0SXin LI# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 90*43a5ec4eSXin LI# https://toolslick.com/conversion/data/guid 91*43a5ec4eSXin LI#>80 ubequad !0 \b, clsid %#16.16llx 92d38c30c0SXin LI#>>88 ubequad x \b%16.16llx 93d38c30c0SXin LI# test for "Root Entry" inside directory by type 5 value 94d38c30c0SXin LI>66 ubyte 5 95d38c30c0SXin LI# look for CLSID GUID 0 96d38c30c0SXin LI>>88 ubequad 0x0 97d38c30c0SXin LI>>>80 ubequad 0x0 98d38c30c0SXin LI# - Microstation V8 DGN files (www.bentley.com) 99d38c30c0SXin LI# URL: https://en.wikipedia.org/wiki/MicroStation 100d38c30c0SXin LI# Last update on 10/23/2006 by Lester Hightower 101d38c30c0SXin LI# 07/24/2019 by Joerg Jenderek 102d38c30c0SXin LI# Second directory entry name like Dgn~H Dgn~S 103d38c30c0SXin LI>>>>128 lestring16 Dgn~ : Microstation V8 CAD 104d38c30c0SXin LI#!:mime application/x-ole-storage 105d38c30c0SXin LI!:mime application/x-bentley-dgn 106d38c30c0SXin LI# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 107d38c30c0SXin LI!:ext dgn 108d38c30c0SXin LI# 109d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 110d38c30c0SXin LI# Second directory entry name PerfectOffice_ 111d38c30c0SXin LI>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 112d38c30c0SXin LI!:mime application/vnd.wordperfect 113d38c30c0SXin LI# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 114d38c30c0SXin LI!:apple ????WPC7 115d38c30c0SXin LI!:ext mst/wpd/wpg 116d38c30c0SXin LI# 117d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 118d38c30c0SXin LI# Second directory entry name MatOST_ 119d38c30c0SXin LI>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 120d38c30c0SXin LI!:mime application/vnd.ms-works 121d38c30c0SXin LI!:apple ????AWWP 122d38c30c0SXin LI!:ext wps 123d38c30c0SXin LI# 124d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 125d38c30c0SXin LI# 3rd directory entry name WksSSWorkBook 126d38c30c0SXin LI>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 127d38c30c0SXin LI!:mime application/vnd.ms-works 128d38c30c0SXin LI!:apple ????AWSS 129d38c30c0SXin LI!:ext xlr 130d38c30c0SXin LI# 131d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/XLS 132d38c30c0SXin LI# what is the difference to {00020820-0000-0000-c000-000000000046} ? 133d38c30c0SXin LI# Second directory entry name Workbook 134d38c30c0SXin LI>>>>128 lestring16 Workbook 135d38c30c0SXin LI>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 136d38c30c0SXin LI!:mime application/vnd.ms-excel 137d38c30c0SXin LI# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 138d38c30c0SXin LI!:apple ????XLS9 139d38c30c0SXin LI!:ext xls 140d38c30c0SXin LI# 141d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/PPT 142d38c30c0SXin LI# Second directory entry name Object1 Object12 Object35 143d38c30c0SXin LI>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 144d38c30c0SXin LI!:mime application/vnd.ms-powerpoint 145d38c30c0SXin LI# https://www.macdisk.com/macsigen.php 146d38c30c0SXin LI!:apple ????PPT3 147d38c30c0SXin LI!:ext ppt 148d38c30c0SXin LI# 149d38c30c0SXin LI# URL: https://www.msoutlook.info/question/164 150d38c30c0SXin LI# Second directory entry name __CollDataStm 151d38c30c0SXin LI>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 152d38c30c0SXin LI#!:mime application/vnd.ms-outlook 153d38c30c0SXin LI!:mime application/x-ms-srs 154d38c30c0SXin LI# %APPDATA%\Microsoft\Outlook\Outlook.srs 155d38c30c0SXin LI!:ext srs 156d38c30c0SXin LI# 157d38c30c0SXin LI# URL: https://www.file-extensions.org/cag-file-extension 158d38c30c0SXin LI# Second directory entry name Category 159d38c30c0SXin LI>>>>128 lestring16 Category : Microsoft Clip Art Gallery 160d38c30c0SXin LI#!:mime application/x-ole-storage 161d38c30c0SXin LI!:mime application/x-ms-cag 162d38c30c0SXin LI!:apple MScgCGdb 163d38c30c0SXin LI!:ext cag/ 164d38c30c0SXin LI# 165d38c30c0SXin LI# URL: https://www.filesuffix.com/de/extension/rra 166d38c30c0SXin LI# 3rd directory entry name StrIndex_StringTable 167d38c30c0SXin LI>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 168d38c30c0SXin LI#!:mime application/x-ole-storage 169d38c30c0SXin LI!:mime application/x-ms-rra 170d38c30c0SXin LI!:ext rra 171d38c30c0SXin LI# 172d38c30c0SXin LI# URL: https://www.forensicswiki.org/wiki/Jump_Lists 173d38c30c0SXin LI# 3rd directory entry name DestList 174d38c30c0SXin LI>>>>256 lestring16 DestList : Windows jump list 175d38c30c0SXin LI#!:mime application/x-ole-storage 176d38c30c0SXin LI!:mime application/x-ms-jumplist 177d38c30c0SXin LI# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 178d38c30c0SXin LI!:ext automaticDestinations-ms 179d38c30c0SXin LI# 180d38c30c0SXin LI# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 181d38c30c0SXin LI# Second directory entry name 256_ 182d38c30c0SXin LI>>>>128 lestring16 256_ : Windows thumbnail database 256 183d38c30c0SXin LI#!:mime application/x-ole-storage 184d38c30c0SXin LI!:mime application/x-ms-thumbnail 185d38c30c0SXin LI# Thumbs.db 186d38c30c0SXin LI!:ext db 187d38c30c0SXin LI>>>>128 lestring16 96_ : Windows thumbnail database 96 188d38c30c0SXin LI!:mime application/x-ms-thumbnail 189d38c30c0SXin LI!:ext db 190d38c30c0SXin LI# 3rd directory entry name Catalog_ 191d38c30c0SXin LI>>>>256 lestring16 Catalog : Windows thumbnail database 192d38c30c0SXin LI!:mime application/x-ms-thumbnail 193d38c30c0SXin LI!:ext db 194d38c30c0SXin LI# 195d38c30c0SXin LI# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 196d38c30c0SXin LI# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 197d38c30c0SXin LI# Second directory entry name Control000 198d38c30c0SXin LI>>>>128 lestring16 Control000 : Microsoft old Systeminfo 199d38c30c0SXin LI#!:mime application/x-ole-storage 200d38c30c0SXin LI!:mime application/x-ms-info 201d38c30c0SXin LI!:ext nfo 202d38c30c0SXin LI# 203d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 204d38c30c0SXin LI# Second directory entry name Thumbnail 205d38c30c0SXin LI>>>>128 lestring16 Thumbnail : Corel PrintHouse image 206d38c30c0SXin LI#!:mime application/x-ole-storage 207d38c30c0SXin LI!:mime application/x-corel-cph 208d38c30c0SXin LI!:ext cph 209d38c30c0SXin LI# 3rd directory entry name Thumbnail 210d38c30c0SXin LI>>>>256 lestring16 Thumbnail : Corel PrintHouse image 211d38c30c0SXin LI!:mime application/x-corel-cph 212d38c30c0SXin LI!:ext cph 213*43a5ec4eSXin LI# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 214*43a5ec4eSXin LI# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album 215*43a5ec4eSXin LI# third directory entry name _INFO_ 216*43a5ec4eSXin LI>>>>256 lestring16 _INFO_ : Corel Gallery 217*43a5ec4eSXin LI# second directory entry name _ITEM_ or _DATA_ 218*43a5ec4eSXin LI# later directory entry names: _ALBUM_ _THUMBNAIL_ 219*43a5ec4eSXin LI#!:mime application/x-ole-storage 220*43a5ec4eSXin LI!:mime application/x-corel-gal 221*43a5ec4eSXin LI!:ext gal 222d38c30c0SXin LI# 223d38c30c0SXin LI# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 224d38c30c0SXin LI# Note: "HWP Document File" signature found in FileHeader 225d38c30c0SXin LI# Second directory entry name FileHeader hint for Thinkfree Office document 226d38c30c0SXin LI>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 227d38c30c0SXin LI#!:mime application/haansofthwp 228d38c30c0SXin LI!:mime application/x-hwp 229d38c30c0SXin LI# https://example-files.online-convert.com/document/hwp/example.hwp 230d38c30c0SXin LI!:ext hwp 231d38c30c0SXin LI# 232d38c30c0SXin LI# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 233d38c30c0SXin LI# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 234d38c30c0SXin LI>>>>128 lestring16 dd2 : StarOffice Gallery view 235d38c30c0SXin LI#!:mime application/x-ole-storage 236d38c30c0SXin LI!:mime application/x-star-sdv 237d38c30c0SXin LI!:ext sdv 2382726a701SXin LI# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 2392726a701SXin LI# second directory entry name Current User 2402726a701SXin LI>>>>128 lestring16 Current\ User : SoftMaker 2412726a701SXin LI# third directory entry name SMNativeObjData 2422726a701SXin LI>>>>>256 lestring16 SMNativeObjData 243*43a5ec4eSXin LI# 5th directory entry name PowerPoint 2442726a701SXin LI>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 2452726a701SXin LI!:mime application/vnd.ms-powerpoint 2462726a701SXin LI!:ext ppt/pps/pot 2472726a701SXin LI# 4th directory entry name PowerPoint 2482726a701SXin LI>>>>>384 lestring16 PowerPoint Presentations or template 2492726a701SXin LI# http://extension.nirsoft.net/prv 2502726a701SXin LI!:mime application/vnd.softmaker.presentations 2512726a701SXin LI!:ext prd/prv 2522726a701SXin LI# third directory entry name like Current User 2532726a701SXin LI>>>>256 lestring16 Current\ User : SoftMaker 2542726a701SXin LI# 5th directory entry name PowerPoint 2552726a701SXin LI>>>>>512 lestring16 PowerPoint Presentations or template 2562726a701SXin LI# http://extension.nirsoft.net/prd 2572726a701SXin LI!:mime application/vnd.softmaker.presentations 2582726a701SXin LI!:ext prd/prv 2592726a701SXin LI# 2nd directory entry name Pictures 2602726a701SXin LI>>>>>>128 lestring16 Pictures with pictures 261d38c30c0SXin LI# remaining null clsid 262d38c30c0SXin LI>>>>128 default x : UNKNOWN 263*43a5ec4eSXin LI# second directory entry name like VisioDocument Control000 264*43a5ec4eSXin LI>>>>>128 lestring16 x with names %.20s 265*43a5ec4eSXin LI# third directory entry like WordDocument 266*43a5ec4eSXin LI>>>>>256 lestring16 x %.20s 267*43a5ec4eSXin LI# forth 268*43a5ec4eSXin LI>>>>>384 lestring16 x %.20s 269d38c30c0SXin LI!:mime application/x-ole-storage 270d38c30c0SXin LI# look for known clsid GUID 271d38c30c0SXin LI# - Visio documents 272d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Visio 273d38c30c0SXin LI# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 274d38c30c0SXin LI>>88 ubequad 0xc000000000000046 : Microsoft 275d38c30c0SXin LI>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 276d38c30c0SXin LI!:mime application/vnd.visio 277d38c30c0SXin LI# VSD~Drawing VSS~Stencil VST~Template 278d38c30c0SXin LI!:ext vsd/vss/vst 279d38c30c0SXin LI>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 280d38c30c0SXin LI!:mime application/vnd.visio 281d38c30c0SXin LI!:ext vsd/vss/vst 282d38c30c0SXin LI# 283d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 284d38c30c0SXin LI>>>80 ubequad 0x84100c0000000000 Windows Installer Package 285d38c30c0SXin LI!:mime application/x-msi 286d38c30c0SXin LI#!:mime application/x-ms-win-installer 287d38c30c0SXin LI!:ext msi 288d38c30c0SXin LI>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 289d38c30c0SXin LI# ?? 290d38c30c0SXin LI!:mime application/x-wine-extension-msp 291d38c30c0SXin LI#!:mime application/x-ms-msp 292d38c30c0SXin LI!:ext msp 293d38c30c0SXin LI# 294d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/DOC 295d38c30c0SXin LI>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 296d38c30c0SXin LI!:mime application/msword 297d38c30c0SXin LI# for template MSWDW8TN 298d38c30c0SXin LI!:apple MSWDWDBN 299d38c30c0SXin LI!:ext doc/dot 300d38c30c0SXin LI>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 301d38c30c0SXin LI!:mime application/msword 302d38c30c0SXin LI!:apple MSWDWDBN 303d38c30c0SXin LI# dot for template; no extension on Macintosh 304d38c30c0SXin LI!:ext doc/dot/ 305d38c30c0SXin LI# 306d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 307d38c30c0SXin LI>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 308d38c30c0SXin LI!:mime application/vnd.ms-works 309d38c30c0SXin LI!:apple ????AWWP 310d38c30c0SXin LI# ps for template https://filext.com/file-extension/PS bps for backup 311d38c30c0SXin LI!:ext wps/ps/bps 312d38c30c0SXin LI# 313d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 314d38c30c0SXin LI>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 315d38c30c0SXin LI!:mime application/vnd.ms-works-db 316d38c30c0SXin LI# https://www.macdisk.com/macsigen.php 317d38c30c0SXin LI!:apple ????AWDB 318d38c30c0SXin LI# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 319d38c30c0SXin LI!:ext wdb/db/bdb 320d38c30c0SXin LI# 321d38c30c0SXin LI# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 322d38c30c0SXin LI>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 323d38c30c0SXin LI!:mime application/vnd.ms-excel 324d38c30c0SXin LI# https://www.macdisk.com/macsigen.php 325d38c30c0SXin LI!:apple ????XLS5 326d38c30c0SXin LI# worksheet/addin/template/no extension on Macintosh 327d38c30c0SXin LI!:ext xls/xla/xlt/ 328d38c30c0SXin LI# 329d38c30c0SXin LI>>>80 ubequad 0x2008020000000000 Excel 97-2003 330d38c30c0SXin LI!:mime application/vnd.ms-excel 331d38c30c0SXin LI# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 332d38c30c0SXin LI!:apple ????XLS9 333*43a5ec4eSXin LI# 3rd directory entry name 334d38c30c0SXin LI>>>>256 lestring16 _VBA_PROJECT_CUR addin 335d38c30c0SXin LI!:ext xla/ 336d38c30c0SXin LI# 4th directory entry name 337d38c30c0SXin LI>>>>384 lestring16 _VBA_PROJECT_CUR addin 338d38c30c0SXin LI!:ext xla 339d38c30c0SXin LI#!:ext xla/ 340d38c30c0SXin LI>>>>256 default x worksheet or template 341d38c30c0SXin LI!:ext xls/xlt 342d38c30c0SXin LI#!:ext xls/xlt/ 343d38c30c0SXin LI# 344d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/OLE2 345d38c30c0SXin LI>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 346d38c30c0SXin LI#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 347d38c30c0SXin LI#!:mime application/vnd.ms-outlook 348d38c30c0SXin LI!:mime application/x-ms-msg 349d38c30c0SXin LI!:ext msg 350d38c30c0SXin LI# URL: https://wiki.fileformat.com/email/oft/ 351d38c30c0SXin LI>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 352d38c30c0SXin LI#!:mime application/vnd.ms-outlook 353d38c30c0SXin LI!:mime application/x-ms-oft 354d38c30c0SXin LI!:ext oft 355d38c30c0SXin LI# 356d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/PPT 357d38c30c0SXin LI>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 358d38c30c0SXin LI!:mime application/vnd.ms-powerpoint 359d38c30c0SXin LI# https://www.macdisk.com/macsigen.php 360d38c30c0SXin LI!:apple ????PPT3 361d38c30c0SXin LI!:ext ppt 362d38c30c0SXin LI#?? 363d38c30c0SXin LI# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 364d38c30c0SXin LI>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 365d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 366d38c30c0SXin LI>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 367d38c30c0SXin LI!:mime application/vnd.ms-works 368d38c30c0SXin LI!:apple ????AWWP 369d38c30c0SXin LI!:ext wps 370d38c30c0SXin LI# 371d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 372d38c30c0SXin LI>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 373d38c30c0SXin LI!:mime application/vnd.ms-works-db 374d38c30c0SXin LI!:apple ????AWDB 375d38c30c0SXin LI!:ext wdb/bdb 376d38c30c0SXin LI#?? 377d38c30c0SXin LI>>88 ubequad 0xa40700c04fb932ba : Microsoft 378d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 379d38c30c0SXin LI>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 380d38c30c0SXin LI!:mime application/vnd.ms-works 381d38c30c0SXin LI!:apple ????AWWP 382d38c30c0SXin LI!:ext wps 383*43a5ec4eSXin LI# From: Joerg Jenderek 384*43a5ec4eSXin LI# URL: https://en.wikipedia.org/wiki/Microsoft_Works 385*43a5ec4eSXin LI# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 386*43a5ec4eSXin LI# Note: probably version 6 and 7 387*43a5ec4eSXin LI# organize pictures like JPFG images in streams __cf1 with names like 388*43a5ec4eSXin LI# 001.JPG, 002.JPG ... in streams __fname 389*43a5ec4eSXin LI>>88 ubequad 0xa1c800c04f612452 : Microsoft 390*43a5ec4eSXin LI>>>80 ubequad 0xc0c7266eb98cd311 Works portfolio 391*43a5ec4eSXin LI# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed 392*43a5ec4eSXin LI#!:mime application/x-ole-storage 393*43a5ec4eSXin LI# https://www.iana.org/assignments/media-types/application/vnd.ms-works 394*43a5ec4eSXin LI!:mime application/vnd.ms-works 395*43a5ec4eSXin LI# https://extension.nirsoft.net/wsb 396*43a5ec4eSXin LI# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb 397*43a5ec4eSXin LI!:ext wsb 398d38c30c0SXin LI#?? 399d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 400d38c30c0SXin LI>>88 ubequad 0x00c0000000000046 : Microsoft 401d38c30c0SXin LI>>>80 ubequad 0x0112020000000000 Publisher 402d38c30c0SXin LI!:mime application/vnd.ms-publisher 403d38c30c0SXin LI!:ext pub 404d38c30c0SXin LI# 405d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/PPT 406d38c30c0SXin LI#?? 407d38c30c0SXin LI>>88 ubequad 0xa90300aa00510ea3 : Microsoft 408d38c30c0SXin LI>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 409d38c30c0SXin LI!:mime application/vnd.ms-powerpoint 410d38c30c0SXin LI# https://www.macdisk.com/macsigen.php 411d38c30c0SXin LI!:apple ????PPT3 412d38c30c0SXin LI!:ext ppt/pot 413d38c30c0SXin LI#?? 414d38c30c0SXin LI>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 415d38c30c0SXin LI>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 416d38c30c0SXin LI!:mime application/vnd.ms-powerpoint 417d38c30c0SXin LI!:apple ????PPT3 418d38c30c0SXin LI# /autostart/template 419d38c30c0SXin LI!:ext ppt/pps/pot 420d38c30c0SXin LI# 421d38c30c0SXin LI# URL: https://en.wikipedia.org/wiki/Microsoft_Project 422d38c30c0SXin LI#?? 423d38c30c0SXin LI>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 424d38c30c0SXin LI>>>80 ubequad 0x3a8fb774c8c8d111 Project 425d38c30c0SXin LI!:mime application/vnd.ms-project 426d38c30c0SXin LI!:ext mpp 427d38c30c0SXin LI# 428*43a5ec4eSXin LI# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 429*43a5ec4eSXin LI# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 430*43a5ec4eSXin LI# https://github.com/OneWingedShark/WordPerfect/ 431*43a5ec4eSXin LI# blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm 432*43a5ec4eSXin LI# From: Joerg Jenderek 433*43a5ec4eSXin LI# Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd 434*43a5ec4eSXin LI# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN, 435*43a5ec4eSXin LI# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors 436*43a5ec4eSXin LI>>88 ubequad 0x19370000929679cd : WordPerfect 7 437*43a5ec4eSXin LI>>>80 ubequad 0xff739851ad2d2002 Document 438*43a5ec4eSXin LI!:mime application/vnd.wordperfect 439*43a5ec4eSXin LI#!:apple ????WPC? 440*43a5ec4eSXin LI# https://fossies.org/linux/wp2latex/test/ole6.wpd 441*43a5ec4eSXin LI!:ext wpd 442*43a5ec4eSXin LI#>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE 443*43a5ec4eSXin LI# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end 444*43a5ec4eSXin LI#>>>>>&0 indirect x \b; contains 445*43a5ec4eSXin LI# GRR: the above expression does not work correctly 446*43a5ec4eSXin LI# 447d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 448d38c30c0SXin LI#??? 449d38c30c0SXin LI>>88 ubequad 0x99ae04021c007002 : WordPerfect 450d38c30c0SXin LI>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 451d38c30c0SXin LI!:mime application/x-corelpresentations 452d38c30c0SXin LI#!:mime application/x-shw-viewer 453d38c30c0SXin LI#!:mime image/x-presentations 454d38c30c0SXin LI!:ext shw 455d38c30c0SXin LI# 456d38c30c0SXin LI# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 457d38c30c0SXin LI>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 458d38c30c0SXin LI#!:mime application/x-wpg 459d38c30c0SXin LI#!:mime image/x-wordperfect-graphics 460d38c30c0SXin LI!:mime image/x-wpg 461d38c30c0SXin LI# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 462d38c30c0SXin LI!:apple ????WPC9 463d38c30c0SXin LI!:ext wpg 464d38c30c0SXin LI# 465d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 466d38c30c0SXin LI>>88 ubequad 0x996104021c007002 : StarOffice 467d38c30c0SXin LI>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 468d38c30c0SXin LI# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 469d38c30c0SXin LI!:mime application/x-starwriter 470d38c30c0SXin LI!:ext sdw/vor 471d38c30c0SXin LI# 472d38c30c0SXin LI>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 473d38c30c0SXin LI!:mime application/x-starcalc 474d38c30c0SXin LI!:ext sdc/vor 475d38c30c0SXin LI# 476d38c30c0SXin LI>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 477d38c30c0SXin LI!:mime application/x-starimpress 478d38c30c0SXin LI#!:mime application/x-stardraw 479d38c30c0SXin LI# sda ?? 480d38c30c0SXin LI!:ext sdd/sda/vor 481d38c30c0SXin LI#?? 482d38c30c0SXin LI>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 483d38c30c0SXin LI>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 484d38c30c0SXin LI!:mime application/x-starcalc 485d38c30c0SXin LI!:ext sdc/vor 486d38c30c0SXin LI# 487d38c30c0SXin LI>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 488d38c30c0SXin LI!:mime application/vnd.stardivision.cal 489d38c30c0SXin LI!:ext sdc/vor 490d38c30c0SXin LI# 491d38c30c0SXin LI>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 492d38c30c0SXin LI!:mime application/x-starimpress 493d38c30c0SXin LI!:ext sdd/vor 494d38c30c0SXin LI#?? 495d38c30c0SXin LI>>88 ubequad 0xb12a04021c007002 : StarOffice 496d38c30c0SXin LI>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 497d38c30c0SXin LI!:mime application/x-starmath 498d38c30c0SXin LI!:ext smf 499d38c30c0SXin LI#?? 500d38c30c0SXin LI>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 501d38c30c0SXin LI>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 502d38c30c0SXin LI!:mime application/x-starchart 503d38c30c0SXin LI!:ext sds 504d38c30c0SXin LI#?? 505d38c30c0SXin LI>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 506d38c30c0SXin LI>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 507d38c30c0SXin LI!:mime application/x-starwriter 508d38c30c0SXin LI!:ext sdw/vor 509d38c30c0SXin LI#?? 510d38c30c0SXin LI>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 511d38c30c0SXin LI>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 512d38c30c0SXin LI!:mime application/x-starmath 513d38c30c0SXin LI!:ext smf 514d38c30c0SXin LI# 515d38c30c0SXin LI>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 516d38c30c0SXin LI!:mime application/x-starchart 517d38c30c0SXin LI!:ext sds 518d38c30c0SXin LI#?? 519d38c30c0SXin LI>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 520d38c30c0SXin LI>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 521d38c30c0SXin LI!:mime application/x-starwriter-global 522d38c30c0SXin LI!:ext sgl 523d38c30c0SXin LI#?? 524d38c30c0SXin LI>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 525d38c30c0SXin LI>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 526d38c30c0SXin LI!:mime application/vnd.stardivision.math 527d38c30c0SXin LI!:ext smf 528d38c30c0SXin LI# 529d38c30c0SXin LI>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 530d38c30c0SXin LI!:mime application/vnd.stardivision.draw 531d38c30c0SXin LI!:ext sda/vor 532d38c30c0SXin LI# 533d38c30c0SXin LI>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 534d38c30c0SXin LI!:mime application/vnd.stardivision.impress 535d38c30c0SXin LI# sda is used for what? 536d38c30c0SXin LI!:ext sdd/vor/sda 537d38c30c0SXin LI# 538d38c30c0SXin LI>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 539d38c30c0SXin LI!:mime application/vnd.stardivision.chart 540d38c30c0SXin LI!:ext sds 541d38c30c0SXin LI# ?? 542d38c30c0SXin LI>>88 ubequad 0xaab4006097da561a : StarOffice 543d38c30c0SXin LI>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 544d38c30c0SXin LI!:mime application/vnd.stardivision.writer 545d38c30c0SXin LI!:ext sdw/vor 546d38c30c0SXin LI# 547d38c30c0SXin LI>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 548d38c30c0SXin LI!:mime application/vnd.stardivision.writer-global 549d38c30c0SXin LI!:ext sgl 550d38c30c0SXin LI#?? 551d38c30c0SXin LI# URL: http://fileformats.archiveteam.org/wiki/FlashPix 552d38c30c0SXin LI>>88 ubequad 0x855300aa00a1f95b : Kodak 553d38c30c0SXin LI>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 554d38c30c0SXin LI!:mime image/vnd.fpx 555d38c30c0SXin LI!:apple ????FPix 556d38c30c0SXin LI!:ext fpx 5572726a701SXin LI# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 5582726a701SXin LI>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 5592726a701SXin LI>>>80 ubequad 0x9174088a6452d411 document or template 5602726a701SXin LI!:mime application/vnd.softmaker.planmaker 5612726a701SXin LI# pmv for template https://www.file-extensions.org/pmv-file-extension 5622726a701SXin LI!:ext pmd/pmv 563d38c30c0SXin LI# remaining non null clsid 564d38c30c0SXin LI>>88 default x : UNKNOWN 565d38c30c0SXin LI!:mime application/x-ole-storage 566*43a5ec4eSXin LI>>>80 ubequad !0 \b, clsid %#16.16llx 567d38c30c0SXin LI>>>88 ubequad x \b%16.16llx 56858a0f0d0SEitan Adler 569