Tool · Files

File signature identifier

Identify a file from its leading bytes across 67 signatures, including SQLite, EVTX, registry hives, Prefetch, LNK and E01, and flag extension mismatches.

LocalRuns entirely in this browser tab. Files are read from your device and are never uploaded.

Choose a fileOnly the first 32 KB are read

Signature reference 67

Every signature this tool checks, grouped by category. Offsets are in bytes from the start of the file; ?? matches any byte.

Documents
Format	Offset	Signature (hex)	Extensions
PDF document	0x0	25 50 44 46 2D	.pdf
OLE2 Compound File (CFB)	0x0	D0 CF 11 E0 A1 B1 1A E1	.doc .xls .ppt .msg .msi .db
Rich Text Format	0x0	7B 5C 72 74 66	.rtf
XML document	0x0	3C 3F 78 6D 6C	.xml .plist .svg
Outlook PST/OST	0x0	21 42 44 4E	.pst .ost

Archives
Format	Offset	Signature (hex)	Extensions
ZIP archive	0x0	50 4B 03 04	.zip .docx .xlsx .pptx .odt .ods .odp .jar .apk .epub .kmz
ZIP archive (empty)	0x0	50 4B 05 06	.zip
RAR archive v5	0x0	52 61 72 21 1A 07 01 00	.rar
RAR archive v1.5–4	0x0	52 61 72 21 1A 07 00	.rar
7-Zip archive	0x0	37 7A BC AF 27 1C	.7z
GZIP stream	0x0	1F 8B 08	.gz .tgz
BZIP2 stream	0x0	42 5A 68	.bz2
XZ stream	0x0	FD 37 7A 58 5A 00	.xz
TAR archive (POSIX ustar)	0x101	75 73 74 61 72	.tar
Microsoft Cabinet	0x0	4D 53 43 46	.cab

Images
Format	Offset	Signature (hex)	Extensions
PNG image	0x0	89 50 4E 47 0D 0A 1A 0A	.png
JPEG image	0x0	FF D8 FF	.jpg .jpeg .jpe .jfif
GIF image	0x0	47 49 46 38	.gif
BMP image	0x0	42 4D	.bmp .dib
TIFF image (little-endian)	0x0	49 49 2A 00	.tif .tiff .dng .nef .cr2 .arw
TIFF image (big-endian)	0x0	4D 4D 00 2A	.tif .tiff .nef
WebP image	0x0	52 49 46 46 ?? ?? ?? ?? 57 45 42 50	.webp
HEIF/HEIC image	0x4	66 74 79 70 68 65 69 63	.heic .heif
Windows icon	0x0	00 00 01 00	.ico
Photoshop document	0x0	38 42 50 53	.psd

Audio and video
Format	Offset	Signature (hex)	Extensions
ISO base media (MP4/M4A/3GP)	0x4	66 74 79 70	.mp4 .m4a .m4v .3gp
QuickTime movie	0x4	66 74 79 70 71 74 20 20	.mov
AVI video	0x0	52 49 46 46 ?? ?? ?? ?? 41 56 49 20	.avi
WAVE audio	0x0	52 49 46 46 ?? ?? ?? ?? 57 41 56 45	.wav
Matroska/WebM	0x0	1A 45 DF A3	.mkv .webm
MP3 with ID3 tag	0x0	49 44 33	.mp3
FLAC audio	0x0	66 4C 61 43	.flac
Ogg container	0x0	4F 67 67 53	.ogg .oga .ogv .opus

Executables
Format	Offset	Signature (hex)	Extensions
DOS/Windows executable (MZ)	0x0	4D 5A	.exe .dll .sys .scr .ocx .cpl
ELF executable	0x0	7F 45 4C 46	.elf .so .o
Mach-O 64-bit	0x0	CF FA ED FE	.dylib
Mach-O 32-bit	0x0	CE FA ED FE	.dylib
Java class or Mach-O universal binary	0x0	CA FE BA BE	.class
Android DEX bytecode	0x0	64 65 78 0A	.dex

Forensic artifacts
Format	Offset	Signature (hex)	Extensions
SQLite 3 database	0x0	53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00	.sqlite .db .sqlite3 .sqlitedb .storedata
SQLite write-ahead log	0x0	37 7F 06 82	.db-wal .sqlite-wal .wal
Windows registry hive	0x0	72 65 67 66	.dat .hve
Windows XML event log (EVTX)	0x0	45 6C 66 46 69 6C 65 00	.evtx
Windows legacy event log (EVT)	0x4	4C 66 4C 65	.evt
Windows shortcut (LNK)	0x0	4C 00 00 00 01 14 02 00	.lnk
Windows Prefetch (MAM compressed)	0x0	4D 41 4D 04	.pf
Windows Prefetch (uncompressed SCCA)	0x4	53 43 43 41	.pf
ESE (JET Blue) database	0x4	EF CD AB 89	.dat .edb .db
Windows thumbcache	0x0	43 4D 4D 4D	.db
Apple binary property list	0x0	62 70 6C 69 73 74 30 30	.plist .bplist
PCAP capture (little-endian)	0x0	D4 C3 B2 A1	.pcap .cap
PCAP capture (big-endian)	0x0	A1 B2 C3 D4	.pcap .cap
PCAPNG capture	0x0	0A 0D 0D 0A	.pcapng

Disk images and volumes
Format	Offset	Signature (hex)	Extensions
Expert Witness Format image (E01)	0x0	45 56 46 09 0D 0A FF 00	.e01
Virtual Hard Disk (VHD footer copy)	0x0	63 6F 6E 65 63 74 69 78	.vhd
Virtual Hard Disk v2 (VHDX)	0x0	76 68 64 78 66 69 6C 65	.vhdx
VMware sparse disk (VMDK)	0x0	4B 44 4D 56	.vmdk
QEMU copy-on-write disk	0x0	51 46 49 FB	.qcow2 .qcow
ISO 9660 disc image	0x8001	43 44 30 30 31	.iso
NTFS volume boot record	0x3	4E 54 46 53 20 20 20 20	.dd .raw .img .001
exFAT volume boot record	0x3	45 58 46 41 54 20 20 20	.dd .raw .img .001
FAT32 volume boot record	0x52	46 41 54 33 32 20 20 20	.dd .raw .img .001
BitLocker-encrypted volume	0x3	2D 46 56 45 2D 46 53 2D	.dd .raw .img .001
LUKS encrypted volume	0x0	4C 55 4B 53 BA BE	.img

Other
Format	Offset	Signature (hex)	Extensions
KeePass 2 database	0x0	03 D9 A2 9A	.kdbx
WOFF font	0x0	77 4F 46 46	.woff
WOFF2 font	0x0	77 4F 46 32	.woff2

Other tools

Integrity
Hash calculator
Compute MD5, SHA-1, SHA-256 and SHA-512 for a local file, compare against a reference value and save a hash record.
Files
Hex viewer and data inspector
Browse any local file in hex, search for bytes or text, and decode the selected offset as integers, floats, FILETIME, Unix, FAT, Apple time and GUID.
Media
Exif and GPS reader
Read camera, time and GPS tags from a JPEG or TIFF locally, convert OffsetTime-qualified dates to UTC and see coordinates in decimal degrees.
Data
Encoding decoder
Decode Base64, Base64url, hex, binary, URL encoding, UTF-16LE and ROT13 side by side, and encode text for search terms.
Mobile
IMEI structure check
Split an IMEI or IMEISV into TAC, serial number and check digit, and verify the Luhn check digit defined in 3GPP TS 23.003.
Time
Timestamp decoder
Paste an unknown number and see it decoded as Unix (s, ms, µs, ns), FILETIME, WebKit, Apple absolute, HFS+, GPS and FAT time, with plausibility flags.
Time
Local time to UTC
Convert a wall-clock time in any IANA zone to UTC using historical daylight-saving rules, and flag times that are skipped or repeated.

Workspace

Signature reference 67

Other tools

Hash calculator

Hex viewer and data inspector

Exif and GPS reader

Encoding decoder

IMEI structure check

Timestamp decoder

Local time to UTC