1 2#------------------------------------------------------------------------------ 3# $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $ 4# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 5# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 6# Additional tests for OLE 2 Compound Documents should be under this recipe. 7# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 8 90 string \320\317\021\340\241\261\032\341 10# https://digital-preservation.github.io/droid/ 11# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 12>0x1A ushort !0xABAB OLE 2 Compound Document 13#>0x1C uleshort x \b, endnian 0x%4.4x 14# big endian not tested 15>>0x1C ubeshort =0xfffe \b, big-endian 16>>>546 string jbjb : Microsoft Word Document 17!:mime application/msword 18!:apple MSWDWDBN 19!:ext doc 20# Byte Order 0xFFFE means little-endian found in real world applications 21#>>0x1C uleshort =0xfffe \b, little-endian 22>>0x1C uleshort =0xfffe 23# From: Joerg Jenderek 24# Major Version 3 or 4 25>>>0x1A uleshort x \b, v%u 26# Minor Version 32h=50 3Bh=59 3Eh=62 27>>>0x18 uleshort x \b.%u 28# SecID of first sector of the directory stream is often 1 but high like 3144h 29>>>48 ulelong x \b, SecID 0x%x 30# pointer to root entry only works with standard configuration for SecID ~< 800h 31# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 32# "ORLEN Factbook 2017.xls" XnView_metadata.doc 33# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 34>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 35# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 36>>>0x1E uleshort 0xc \b, blocksize 4096 37# jump to one block (4096 bytes per block) before root storage block 38>>>>(48.l*4096) ubyte x 39>>>>>&4095 use ole2-directory 40#>>>0x1E uleshort 9 \b, blocksize 512 41>>>0x1E uleshort 9 42# jump to one block (512 bytes per block) before root storage block 43# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 44>>>>(48.l*512) ubyte x 45>>>>>&511 use ole2-directory 46# check directory entry structure and display types by GUID 470 name ole2-directory 48# directory entry name like "Root Entry" 49#>0 lestring16 x \b, 1st %.10s 50# type of the entry; 5~Root storage 51#>66 ubyte x \b, type %x 52# node colour of the entry: 00H ~ Red 01H ~ Black 53#>67 ubyte x \b, color %x 54# the DirIDs of the child nodes. Should both be –1 in the root storage entry 55#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 56# second directory entry name like VisioDocument Control000 57#>128 lestring16 x \b, 2nd %.20s 58# third directory entry like WordDocument 59#>256 lestring16 x \b, 3rd %.20s 60# forth 61#>384 lestring16 x \b, 4th %.10s 62# 5th 63#>512 lestring16 x \b, 5th %.10s 64# 6th 65#>640 lestring16 x \b, 6th %.10s 66# 7th 67#>768 lestring16 x \b, 7th %.10s 68# https://wikileaks.org/ciav7p1/cms/page_13762814.html 69# https://m.blog.naver.com/superman4u/40047693679 70# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 71# http://www.windowstricks.in/online-windows-guid-converter 72#>80 ubequad !0 \b, clsid 0x%16.16llx 73#>>88 ubequad x \b%16.16llx 74# test for "Root Entry" inside directory by type 5 value 75>66 ubyte 5 76# look for CLSID GUID 0 77>>88 ubequad 0x0 78>>>80 ubequad 0x0 79# - Microstation V8 DGN files (www.bentley.com) 80# URL: https://en.wikipedia.org/wiki/MicroStation 81# Last update on 10/23/2006 by Lester Hightower 82# 07/24/2019 by Joerg Jenderek 83# Second directory entry name like Dgn~H Dgn~S 84>>>>128 lestring16 Dgn~ : Microstation V8 CAD 85#!:mime application/x-ole-storage 86!:mime application/x-bentley-dgn 87# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 88!:ext dgn 89# 90# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 91# Second directory entry name PerfectOffice_ 92>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 93!:mime application/vnd.wordperfect 94# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 95!:apple ????WPC7 96!:ext mst/wpd/wpg 97# 98# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 99# Second directory entry name MatOST_ 100>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 101!:mime application/vnd.ms-works 102!:apple ????AWWP 103!:ext wps 104# 105# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 106# 3rd directory entry name WksSSWorkBook 107>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 108!:mime application/vnd.ms-works 109!:apple ????AWSS 110!:ext xlr 111# 112# URL: http://fileformats.archiveteam.org/wiki/XLS 113# what is the difference to {00020820-0000-0000-c000-000000000046} ? 114# Second directory entry name Workbook 115>>>>128 lestring16 Workbook 116>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 117!:mime application/vnd.ms-excel 118# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 119!:apple ????XLS9 120!:ext xls 121# 122# URL: http://fileformats.archiveteam.org/wiki/PPT 123# Second directory entry name Object1 Object12 Object35 124>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 125!:mime application/vnd.ms-powerpoint 126# https://www.macdisk.com/macsigen.php 127!:apple ????PPT3 128!:ext ppt 129# 130# URL: https://www.msoutlook.info/question/164 131# Second directory entry name __CollDataStm 132>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 133#!:mime application/vnd.ms-outlook 134!:mime application/x-ms-srs 135# %APPDATA%\Microsoft\Outlook\Outlook.srs 136!:ext srs 137# 138# URL: https://www.file-extensions.org/cag-file-extension 139# Second directory entry name Category 140>>>>128 lestring16 Category : Microsoft Clip Art Gallery 141#!:mime application/x-ole-storage 142!:mime application/x-ms-cag 143!:apple MScgCGdb 144!:ext cag/ 145# 146# URL: https://www.filesuffix.com/de/extension/rra 147# 3rd directory entry name StrIndex_StringTable 148>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 149#!:mime application/x-ole-storage 150!:mime application/x-ms-rra 151!:ext rra 152# 153# URL: https://www.forensicswiki.org/wiki/Jump_Lists 154# 3rd directory entry name DestList 155>>>>256 lestring16 DestList : Windows jump list 156#!:mime application/x-ole-storage 157!:mime application/x-ms-jumplist 158# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 159!:ext automaticDestinations-ms 160# 161# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 162# Second directory entry name 256_ 163>>>>128 lestring16 256_ : Windows thumbnail database 256 164#!:mime application/x-ole-storage 165!:mime application/x-ms-thumbnail 166# Thumbs.db 167!:ext db 168>>>>128 lestring16 96_ : Windows thumbnail database 96 169!:mime application/x-ms-thumbnail 170!:ext db 171# 3rd directory entry name Catalog_ 172>>>>256 lestring16 Catalog : Windows thumbnail database 173!:mime application/x-ms-thumbnail 174!:ext db 175# 176# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 177# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 178# Second directory entry name Control000 179>>>>128 lestring16 Control000 : Microsoft old Systeminfo 180#!:mime application/x-ole-storage 181!:mime application/x-ms-info 182!:ext nfo 183# 184# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 185# Second directory entry name Thumbnail 186>>>>128 lestring16 Thumbnail : Corel PrintHouse image 187#!:mime application/x-ole-storage 188!:mime application/x-corel-cph 189!:ext cph 190# 3rd directory entry name Thumbnail 191>>>>256 lestring16 Thumbnail : Corel PrintHouse image 192!:mime application/x-corel-cph 193!:ext cph 194# 195# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 196# Note: "HWP Document File" signature found in FileHeader 197# Second directory entry name FileHeader hint for Thinkfree Office document 198>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 199#!:mime application/haansofthwp 200!:mime application/x-hwp 201# https://example-files.online-convert.com/document/hwp/example.hwp 202!:ext hwp 203# 204# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 205# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 206>>>>128 lestring16 dd2 : StarOffice Gallery view 207#!:mime application/x-ole-storage 208!:mime application/x-star-sdv 209!:ext sdv 210# remaining null clsid 211>>>>128 default x : UNKNOWN 212!:mime application/x-ole-storage 213# look for known clsid GUID 214# - Visio documents 215# URL: http://fileformats.archiveteam.org/wiki/Visio 216# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 217>>88 ubequad 0xc000000000000046 : Microsoft 218>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 219!:mime application/vnd.visio 220# VSD~Drawing VSS~Stencil VST~Template 221!:ext vsd/vss/vst 222>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 223!:mime application/vnd.visio 224!:ext vsd/vss/vst 225# 226# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 227>>>80 ubequad 0x84100c0000000000 Windows Installer Package 228!:mime application/x-msi 229#!:mime application/x-ms-win-installer 230!:ext msi 231>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 232# ?? 233!:mime application/x-wine-extension-msp 234#!:mime application/x-ms-msp 235!:ext msp 236# 237# URL: http://fileformats.archiveteam.org/wiki/DOC 238>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 239!:mime application/msword 240# for template MSWDW8TN 241!:apple MSWDWDBN 242!:ext doc/dot 243>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 244!:mime application/msword 245!:apple MSWDWDBN 246# dot for template; no extension on Macintosh 247!:ext doc/dot/ 248# 249# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 250>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 251!:mime application/vnd.ms-works 252!:apple ????AWWP 253# ps for template https://filext.com/file-extension/PS bps for backup 254!:ext wps/ps/bps 255# 256# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 257>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 258!:mime application/vnd.ms-works-db 259# https://www.macdisk.com/macsigen.php 260!:apple ????AWDB 261# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 262!:ext wdb/db/bdb 263# 264# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 265>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 266!:mime application/vnd.ms-excel 267# https://www.macdisk.com/macsigen.php 268!:apple ????XLS5 269# worksheet/addin/template/no extension on Macintosh 270!:ext xls/xla/xlt/ 271# 272>>>80 ubequad 0x2008020000000000 Excel 97-2003 273!:mime application/vnd.ms-excel 274# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 275!:apple ????XLS9 276# 3nd directory entry name 277>>>>256 lestring16 _VBA_PROJECT_CUR addin 278!:ext xla/ 279# 4th directory entry name 280>>>>384 lestring16 _VBA_PROJECT_CUR addin 281!:ext xla 282#!:ext xla/ 283>>>>256 default x worksheet or template 284!:ext xls/xlt 285#!:ext xls/xlt/ 286# 287# URL: http://fileformats.archiveteam.org/wiki/OLE2 288>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 289#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 290#!:mime application/vnd.ms-outlook 291!:mime application/x-ms-msg 292!:ext msg 293# URL: https://wiki.fileformat.com/email/oft/ 294>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 295#!:mime application/vnd.ms-outlook 296!:mime application/x-ms-oft 297!:ext oft 298# 299# URL: http://fileformats.archiveteam.org/wiki/PPT 300>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 301!:mime application/vnd.ms-powerpoint 302# https://www.macdisk.com/macsigen.php 303!:apple ????PPT3 304!:ext ppt 305#?? 306# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 307>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 308# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 309>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 310!:mime application/vnd.ms-works 311!:apple ????AWWP 312!:ext wps 313# 314# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 315>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 316!:mime application/vnd.ms-works-db 317!:apple ????AWDB 318!:ext wdb/bdb 319#?? 320>>88 ubequad 0xa40700c04fb932ba : Microsoft 321# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 322>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 323!:mime application/vnd.ms-works 324!:apple ????AWWP 325!:ext wps 326#?? 327# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 328>>88 ubequad 0x00c0000000000046 : Microsoft 329>>>80 ubequad 0x0112020000000000 Publisher 330!:mime application/vnd.ms-publisher 331!:ext pub 332# 333# URL: http://fileformats.archiveteam.org/wiki/PPT 334#?? 335>>88 ubequad 0xa90300aa00510ea3 : Microsoft 336>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 337!:mime application/vnd.ms-powerpoint 338# https://www.macdisk.com/macsigen.php 339!:apple ????PPT3 340!:ext ppt/pot 341#?? 342>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 343>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 344!:mime application/vnd.ms-powerpoint 345!:apple ????PPT3 346# /autostart/template 347!:ext ppt/pps/pot 348# 349# URL: https://en.wikipedia.org/wiki/Microsoft_Project 350#?? 351>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 352>>>80 ubequad 0x3a8fb774c8c8d111 Project 353!:mime application/vnd.ms-project 354!:ext mpp 355# 356# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 357#??? 358>>88 ubequad 0x99ae04021c007002 : WordPerfect 359>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 360!:mime application/x-corelpresentations 361#!:mime application/x-shw-viewer 362#!:mime image/x-presentations 363!:ext shw 364# 365# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 366>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 367#!:mime application/x-wpg 368#!:mime image/x-wordperfect-graphics 369!:mime image/x-wpg 370# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 371!:apple ????WPC9 372!:ext wpg 373# 374# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 375>>88 ubequad 0x996104021c007002 : StarOffice 376>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 377# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 378!:mime application/x-starwriter 379!:ext sdw/vor 380# 381>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 382!:mime application/x-starcalc 383!:ext sdc/vor 384# 385>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 386!:mime application/x-starimpress 387#!:mime application/x-stardraw 388# sda ?? 389!:ext sdd/sda/vor 390#?? 391>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 392>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 393!:mime application/x-starcalc 394!:ext sdc/vor 395# 396>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 397!:mime application/vnd.stardivision.cal 398!:ext sdc/vor 399# 400>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 401!:mime application/x-starimpress 402!:ext sdd/vor 403#?? 404>>88 ubequad 0xb12a04021c007002 : StarOffice 405>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 406!:mime application/x-starmath 407!:ext smf 408#?? 409>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 410>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 411!:mime application/x-starchart 412!:ext sds 413#?? 414>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 415>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 416!:mime application/x-starwriter 417!:ext sdw/vor 418#?? 419>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 420>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 421!:mime application/x-starmath 422!:ext smf 423# 424>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 425!:mime application/x-starchart 426!:ext sds 427#?? 428>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 429>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 430!:mime application/x-starwriter-global 431!:ext sgl 432#?? 433>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 434>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 435!:mime application/vnd.stardivision.math 436!:ext smf 437# 438>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 439!:mime application/vnd.stardivision.draw 440!:ext sda/vor 441# 442>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 443!:mime application/vnd.stardivision.impress 444# sda is used for what? 445!:ext sdd/vor/sda 446# 447>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 448!:mime application/vnd.stardivision.chart 449!:ext sds 450# ?? 451>>88 ubequad 0xaab4006097da561a : StarOffice 452>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 453!:mime application/vnd.stardivision.writer 454!:ext sdw/vor 455# 456>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 457!:mime application/vnd.stardivision.writer-global 458!:ext sgl 459#?? 460# URL: http://fileformats.archiveteam.org/wiki/FlashPix 461>>88 ubequad 0x855300aa00a1f95b : Kodak 462>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 463!:mime image/vnd.fpx 464!:apple ????FPix 465!:ext fpx 466# remaining non null clsid 467>>88 default x : UNKNOWN 468!:mime application/x-ole-storage 469>>>80 ubequad !0 \b, clsid 0x%16.16llx 470>>>88 ubequad x \b%16.16llx 471 472