File Signature Reference

Searchable table of 156 file signatures

How to read a file signature

Open the file in a hex editor and read the first few bytes. A PDF begins 25 50 44 46, which is %PDF in ASCII. A PNG begins 89 50 4E 47 0D 0A 1A 0A, where bytes two to four spell PNG and the rest guard against corruption during transfer.

Two details catch people out. Some signatures do not start at byte 0, so the offset matters: the ISO 9660 CD001 magic sits at 32769 and the tar ustar magic at 257. And a signature identifies a container, not always a format. Everything built on ZIP, from DOCX to APK to EPUB, opens with 50 4B 03 04, so the contents decide which it is.

Where this is used

File type verification

An extension is only a label. When the signature disagrees with it, the file has been renamed, deliberately or otherwise, and that mismatch is itself evidence worth documenting.

File carving and data recovery

When the file system is gone, recovery tools scan raw sectors for known headers and, where the format has one, footers. The quality of that carve depends directly on the signature set behind it.

Malware analysis

Payloads are routinely disguised with a harmless extension or padded to look like a document. Reading the header is the first triage step before anything is executed.

Data triage at scale

On a large exhibit, grouping by real signature rather than by extension gives a truthful picture of what is actually present before deeper analysis begins.

Frequently asked questions

What is a file signature?

A file signature, also called a magic number, is a short fixed sequence of bytes at the beginning of a file that identifies its format. It is normally written as hexadecimal, for example 25 50 44 46 for a PDF, which reads as %PDF in ASCII.

Why do file signatures matter in digital forensics?

Extensions can be renamed, but the signature sits inside the file itself. Comparing the two exposes a file whose extension does not match its real format, which is a common way of hiding data. Signatures also drive file carving, where deleted files are recovered from unallocated space by locating their headers.

Can a file signature be faked?

Yes. A header can be edited, so a signature match alone is not proof of format. Examiners confirm the finding against the file's internal structure, its footer where one exists, and whether the file parses correctly in a reader for that format.

What does xx mean in a hex signature?

It marks a byte that changes from file to file, usually part of a length or size field. Those positions should be treated as wildcards when matching.

Do all signatures start at the beginning of the file?

No. Most begin at byte 0, but some do not: the ISO 9660 CD001 magic sits at offset 32769, the tar ustar magic at offset 257, and MP4 or HEIC ftyp brands at offset 4. This table lists the offset wherever it is not zero.

Can two formats share the same signature?

They can. CA FE BA BE is both a Java class file and a Mach-O universal binary, and every ZIP-based format, including DOCX, XLSX, PPTX, ODF, JAR, APK, and EPUB, begins with PK 03 04. Distinguishing them needs the container's internal contents.