#0 byte 0xf0 MS-DOS program library data
#
-#
-# Windows Registry files.
-# updated by Joerg Jenderek
-0 string regf Windows NT/XP registry file
-0 string CREG Windows 95/98/ME registry file
-0 string SHCC3 Windows 3.1 registry file
-
-
# AAF files:
# <stuartc@rd.bbc.co.uk> Stuart Cunningham
0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
!:mime application/vnd.lotus-wordpro
-# Help files
-0 string ?_\3\0 MS Windows Help Data
-
# DeIsL1.isu what this is I don't know
0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
0 string Nullsoft\ AVS\ Preset\ Winamp plug in
-# Hyper terminal:
-0 string HyperTerminal\ hyperterm
->15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal
-
# Windows Metafont .WMF
0 string \327\315\306\232 ms-windows metafont .wmf
0 string \002\000\011\000 ms-windows metafont .wmf
0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
-# Windows help file FTG FTS
-0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
-
-# grp old windows 3.1 group files
-0 string \120\115\103\103 MS Windows 3.1 group files
-
-
-# lnk files windows symlinks
-0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut
-
#ico files
0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
>56 leshort 1 \b, 1 registry entry
>56 leshort >1 \b, %u registry entries
-# Outlook Personal Folders
-0 lelong 0x4E444221 Microsoft Outlook binary email folder
->10 leshort 0x0e (Outlook <=2002)
->10 leshort 0x17 (Outlook >=2003)
-
-
-# From: Dirk Jagdmann <doj@cubic.org>
-0 lelong 0x00035f3f Windows 3.x help file
-
-# Christophe Monniez
-0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File
->20 string >\0 Version %s
-0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File
->4 byte =0xC5 Message database
->4 byte =0xC6 Folder database
->4 byte =0xC7 Accounts informations
->4 byte =0x30 Offline database
-
# Windows Enhanced Metafile (EMF)
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
--- /dev/null
+
+#------------------------------------------------------------------------------
+# windows: file(1) magic for Microsoft Windows
+#
+# This file is mainly reserved for files where programs
+# using them are run almost always on MS Windows 3.x or
+# above, or files only used exclusively in Windows OS,
+# where there is no better category to allocate for.
+# For example, even though WinZIP almost run on Windows
+# only, it is better to treat them as "archive" instead.
+# For format usable in DOS, such as generic executable
+# format, please specify under "msdos" file.
+#
+
+
+# Summary: Outlook Express DBX file
+# Extension: .dbx
+# Created by: Christophe Monniez
+0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
+>4 byte =0xC5 \b, message database
+>4 byte =0xC6 \b, folder database
+>4 byte =0xC7 \b, account information
+>4 byte =0x30 \b, offline database
+
+
+# Summary: Windows crash dump
+# Extension: .dmp
+# Created by: Andreas Schuster (http://computer.forensikblog.de/)
+# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
+# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
+0 string PAGE
+>4 string DUMP MS Windows 32bit crash dump
+>>0x05c byte 0 \b, no PAE
+>>0x05c byte 1 \b, PAE
+>>0xf88 lelong 1 \b, full dump
+>>0xf88 lelong 2 \b, kernel dump
+>>0xf88 lelong 3 \b, small dump
+>>0x068 lelong x \b, %ld pages
+>4 string DU64 MS Windows 64bit crash dump
+>>0xf98 lelong 1 \b, full dump
+>>0xf98 lelong 2 \b, kernel dump
+>>0xf98 lelong 3 \b, small dump
+>>0x090 lequad x \b, %lld pages
+
+
+# Summary: Vista Event Log
+# Extension: .evtx
+# Created by: Andreas Schuster (http://computer.forensikblog.de/)
+# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
+0 string ElfFile\0 MS Windows Vista Event Log
+>0x2a leshort x \b, %d chunks
+>>0x10 lelong x \b (no. %d in use)
+>0x18 lelong >1 \b, next record no. %d
+>0x18 lelong =1 \b, empty
+>0x78 lelong &1 \b, DIRTY
+>0x78 lelong &2 \b, FULL
+
+
+# Summary: Windows 3.1 group files
+# Extension: .grp
+# Created by: unknown
+0 string \120\115\103\103 MS Windows 3.1 group files
+
+
+# Summary: Old format help files
+# Extension: .hlp
+# Created by: Dirk Jagdmann <doj@cubic.org>
+0 lelong 0x00035f3f MS Windows 3.x help file
+
+
+# Summary: Hyper terminal
+# Extension: .ht
+# Created by: unknown
+0 string HyperTerminal\
+>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
+
+
+# Summary: Windows shortcut
+# Extension: .lnk
+# Created by: unknown
+0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
+
+
+# Summary: Outlook Personal Folders
+# Created by: unknown
+0 lelong 0x4E444221 Microsoft Outlook email folder
+>10 leshort 0x0e (<=2002)
+>10 leshort 0x17 (>=2003)
+
+
+# Summary: Windows help cache
+# Created by: unknown
+0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
+
+
+# Summary: IE cache file
+# Created by: Christophe Monniez
+0 string Client\ UrlCache\ MMF Internet Explorer cache file
+>20 string >\0 version %s
+
+
+# Summary: Registry files
+# Created by: unknown
+# Modified by (1): Joerg Jenderek
+0 string regf MS Windows registry file, NT/2000 or above
+0 string CREG MS Windows 95/98/ME registry file
+0 string SHCC3 MS Windows 3.1 registry file
+
+
projects / file / commitdiff