Just Solve the File Format Problem - User contributions [en]

Cpio

2023-03-01T01:47:11Z

J2j: added more samples

{{FormatInfo
|name=cpio
|formattype=electronic
|subcat=Archiving
|extensions={{ext|cpio}}
|mimetypes={{mimetype|application/x-cpio}}
|pronom={{PRONOM|fmt/635}}
}}
{{DISPLAYTITLE:cpio}}

'''cpio''' is a non-compressed file archive format for [[Unix]]-style systems. It was originally intended for tape archiving, similar to the [[Tape Archive]] (tar) format.

== Examples ==
To extract files, using the command line utility:
$ cpio -idmv -I example.cpio

To list files:
$ cpio -it -I example.cpio

== Identification ==
A cpio archive begins with one of the following signatures:
* <code>0x71 0xC7</code>
* <code>0xC7 0x71</code>
* <code>'0' '7' '0' '7'</code>

Be aware that there are [[afio]] extensions to cpio format that are not supported by most cpio utilities. For one thing, if most of the filenames end in ".z", it's probably a compressed afio archive.

== Specifications ==
* [http://people.freebsd.org/~kientzle/libarchive/man/cpio.5.txt cpio format man page]

== Software ==
* [http://www.gnu.org/software/cpio/cpio.html GNU cpio]
* [http://www.libarchive.org libarchive / bsdcpio]
* [http://gnuwin32.sourceforge.net/packages/cpio.htm cpio for Windows]
* [[7-Zip]]
* [[afio]]
* [[Konvertor]]
* {{Deark}}

== Sample files ==
* http://ftp.gnu.org/gnu/tar/tar-1.27.cpio.gz
* https://telparia.com/fileFormatSamples/archive/cpio/
* [https://www.clamav.net/downloads ClamAV Download] → [https://www.clamav.net/downloads/production/clamav-0.103.8.tar.gz 0.103.8 Source] → test/.split → split.clam.*.cpio??

== Other links ==
* [[Wikipedia:cpio|Wikipedia article]]
* [http://www.freebsd.org/cgi/man.cgi?cpio cpio utility man page]
* [http://www.gnu.org/software/cpio/manual/index.html GNU cpio manual]
* [http://rightsock.com/~kjw/Ramblings/tar_v_cpio.html tar vs. cpio]
* [https://web.archive.org/web/20190809160054/http://www.forensicswiki.org/wiki/Cpio ForensicsWiki entry] (no useful detail)

Microsoft Compound File

2022-12-29T00:26:57Z

J2j: correct wrong digit for MST

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], [[Access|Microsoft Access]] wizard template, ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00022C60-0000-0000-C000-000000000046</code> || [[Greenstreet_Publisher|GST]] [[GST_ART|Art drawing]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000C1082-0000-0000-C000-000000000046}</code> || [[Windows Installer]] transform script MST
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{4D29B490-49B2-11D0-93C3-7E0706000000}</code> || |[[IPT|Autodesk Inventor]] Part 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{4F4D4E49-464F-524D-AFDC-0020AF286206}</code> || [[OmniForm]]
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|<code>{597CAA70-72AA-11CF-831E-524153480000}</code> || [[FLA|Adobe Flash]]
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft Compound File

2022-12-29T00:22:25Z

J2j: added Windows Installer transform script MST to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], [[Access|Microsoft Access]] wizard template, ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00022C60-0000-0000-C000-000000000046</code> || [[Greenstreet_Publisher|GST]] [[GST_ART|Art drawing]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer]] transform script MST
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{4D29B490-49B2-11D0-93C3-7E0706000000}</code> || |[[IPT|Autodesk Inventor]] Part 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{4F4D4E49-464F-524D-AFDC-0020AF286206}</code> || [[OmniForm]]
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|<code>{597CAA70-72AA-11CF-831E-524153480000}</code> || [[FLA|Adobe Flash]]
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft Compound File

2022-10-07T00:07:08Z

J2j: added Greenstreet Art drawing to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], [[Access|Microsoft Access]] wizard template, ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00022C60-0000-0000-C000-000000000046</code> || [[Greenstreet_Publisher|GST]] [[GST_ART|Art drawing]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{4D29B490-49B2-11D0-93C3-7E0706000000}</code> || |[[IPT|Autodesk Inventor]] Part 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{4F4D4E49-464F-524D-AFDC-0020AF286206}</code> || [[OmniForm]]
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|<code>{597CAA70-72AA-11CF-831E-524153480000}</code> || [[FLA|Adobe Flash]]
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft Compound File

2022-10-01T16:50:21Z

J2j: added Autodesk Inventor Part to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], [[Access|Microsoft Access]] wizard template, ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{4D29B490-49B2-11D0-93C3-7E0706000000}</code> || |[[IPT|Autodesk Inventor]] Part 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{4F4D4E49-464F-524D-AFDC-0020AF286206}</code> || [[OmniForm]]
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|<code>{597CAA70-72AA-11CF-831E-524153480000}</code> || [[FLA|Adobe Flash]]
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

IPT

2022-10-01T16:47:07Z

J2j: added Wikipedia url

{{FormatInfo
|formattype=electronic
|subcat=3D and CAD/CAM Models
|extensions={{ext|ipt}}
|wikidata={{wikidata|Q735441}}
}}
'''IPT''' (Autodesk Inventor part) is one of the native file formats of Autodesk Inventor, along with [[IAM]] (Autodesk Inventor assembly), [[IDW]] (Autodesk Inventor drawing), and [[IPN]] (Autodesk Inventor presentation). Assemblies consist of arrangements of parts.

Autodesk Inventor has a new major version every year, and it's documented that the assembly file format changes and requires updates to read newer files; it's not clear whether the part files are similarly incompatible from year to year.

== Links ==
* [https://knowledge.autodesk.com/support/3ds-max/learn-explore/caas/CloudHelp/cloudhelp/2019/ENU/3DSMax-Data-Exchange/files/GUID-3DA51A42-AB12-48D6-B6D5-A82B481CD686-htm.html Autodesk Inventor (IPT, IAM) Files] (Autodesk knowledge base)
* [https://knowledge.autodesk.com/support/featurecam-products/learn-explore/caas/CloudHelp/cloudhelp/2020/ENU/PMAKER-ReferenceHelp/files/GUID-186A68B7-CE9F-4377-BA72-A97F297BD1CF-htm.html Import IPT Autodesk Inventor Part File (PartMaker)]
* [https://sites.google.com/a/eng.ucsd.edu/mae3/cad/files/inventor-parts-tutorial?mobile=true Inventor Parts Tutorial]
* [[Wikipedia:Autodesk_Inventor|Wikipedia: Autodesk Inventor]]

[[Category:Microsoft Compound File]]
[[Category:Autodesk]]

ETL

2022-09-28T21:03:26Z

J2j: mime type + software + samples + identification added

{{FormatInfo
|formattype=electronic
|subcat=System files
|extensions={{ext|etl}}
|mimetypes={{mimetype|application/etl}}<ref>http://extension.nirsoft.net/etl</ref>
}}
ETL (Event Trace Log) files store the output of instruments attached to their application, or user or kernel events during real-time. The enable the consumption of those events post- that time.

According to [https://file.org/extension/etl file.org] these files ''"can contain information about disk access and page faults, logging high-frequency events and recording the performance of the Microsoft operating system. This information can be used to analyze and adjust voice response software applications."''

== Identification ==
After the trace log file header the names of the logger and the log file are stored as null-terminated Unicode strings.
So ETL files contain near the beginning the bytes sequence <code>.\0e\0\t\0l\0\0\0</code> triggered by used file name suffix <code>.etl</code>.
<ref>https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm</ref>

== Software ==
* tracerpt
* [https://github.com/airbus-cert/etl-parser etl-parser] Event Trace Log file reader in pure Python

== Sample files ==
* https://github.com/airbus-cert/etl-parser/tree/master/tests/example/

== References ==

* [https://file.org/extension/etl file.org: Opening ETL Files]
* [https://docs.microsoft.com/en-us/windows/desktop/etw/event-tracing-portal Microsoft: Event Tracing]
<references/>

[[Category:Microsoft]]
[[Category:Windows]]

LUKS

2022-09-12T00:40:28Z

J2j: added mime type + extensions + more identification software

{{FormatInfo
|formattype=electronic
|subcat=Encryption
|extensions={{ext|luks}}, {{ext|img}}, {{ext|luksVolumeHeaderBackUp}}<ref>https://bytemeta.vip/repo/mhogomchungu/zuluCrypt/issues/152</ref>
|mimetypes={{mimetype|application/x-raw-disk-image}}<ref>https://reposcope.com/mimetype/application/x-raw-disk-image</ref>
|released=≤2005
}}
[[LUKS]] (Linux Unified Key Setup) is a general-purpose encrypted disk format. It supports, for example, multiple keys, and the possibility of changing keys without re-encrypting the entire volume. Some Linux distributions support LUKS by default, using <code>cryptsetup</code> and related utilities, as if it were an advanced form of [[dm-crypt]].

A LUKS volume begins with a header containing a variety of (unencrypted) information about the encrypted data.

== Identification ==
A LUKS (v1, at least) volume begins with signature bytes {{magic|'L' 'U' 'K' 'S' 0xBA 0xBE}}.
For version 1 this is followed by byte sequence <code>00 01</code>
and for version 2 this is followed by byte sequence <code>00 02</code>.

== Specifications ==
* [https://gitlab.com/cryptsetup/cryptsetup/wikis/Specification LUKS On-Disk Format Specification]

== Software ==
* [https://gitlab.com/cryptsetup/cryptsetup cryptsetup]
* [[Wikipedia:FreeOTFE|FreeOTFE]]
* [http://mhogomchungu.github.io/zuluCrypt/ zuluCrypt]
* [http://mhogomchungu.github.io/zuluCrypt/ zuluMount]

== Links ==
* [[Wikipedia:Linux Unified Key Setup|Wikipedia article]]
* [https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/v2.0.0-ReleaseNotes Cryptsetup 2.0.0 Release Notes] - Introduces LUKS2 format

== References ==
<references/>

RIFF

2022-07-12T16:51:23Z

J2j: Added IDF RIFF subtag

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|locfdd={{LoCFDD|fdd000025}}
|released=1991
}}
The '''Resource Interchange File Format''' ('''RIFF'''), alternatively "'''Reverse [[IFF]]'''", is a wrapper or container format, originally developed by Microsoft and IBM. Formats based on the RIFF container include the widely used [[WAV]] (audio) and [[AVI]] (video) formats.

It is similar to [[IFF]]. One difference is that RIFF uses little-endian [[Endianness|byte order]].

See also [[RIFX]].

== Identification ==
RIFF files begin with the ASCII characters "<code>RIFF</code>".

== RIFF type cross-reference ==
Selected "RIFF types", and related articles, are listed below. The RIFF type (also called "form type" or "RIFF form") is a [[FourCC|four-byte identifier]] that usually appears at file offset 8. See also [[:Category:RIFF based file formats]].

{| class="wikitable"
! RIFF type !! Refer to !! Remarks
|-
| <code>ACON</code> || [[Windows Animated Cursor]] ||
|-
| <code>AMV</code> || [[MTV Video (.AMV)]] ||
|-
| <code>AVI</code> || [[AVI]] ||
|-
| <code>BND</code> || [[RIFF Bundle File]] || Defined in the RIFF specifications.
|-
| <code>CDR?</code> || [[CorelDRAW]] ||
|-
| <code>CDXA</code> || [[MPEG-1]] || wrapped MPEG (CDXA)
|-
| <code>DES?</code> || [[Corel Designer]] ||
|-
| <code>PAL</code> || [[RIFF Palette File]] || Defined in the RIFF specifications.
|-
| <code>RDIB</code> || [[RDIB]] || Defined in the RIFF specifications.
|-
| <code>RMID</code> || [[RIFF MIDI]] || Defined in the RIFF specifications.
|-
| <code>RMMP</code> || [[RIFF Multimedia Movie]] ||
|-
| <code>TRID</code> || [[Trd (TRID)]] ||
|-
| <code>VDRM</code> || [[VDR (VirtualDub)]] ||
|-
| <code>WAVE</code> || [[WAV]] || Defined in the RIFF specifications.
|-
| <code>WEBP</code> || [[WebP]] ||
|-
| <code>sfbk</code> || [[SoundFont 2.0]] ||
|-
| <code>shw4</code> || [[SHW (Corel)]] ||
|-
| <code>MSFX</code> || [[RIFF MSFX]] || Appears to be meta info for .wav's
|-
| <code>MIDS</code> || [[RIFF MIDS]] ||
|-
| <code>STYL</code> || [[RIFF STYL]] ||
|-
| <code>NUND</code> || [[CPR]] [[NPR]] ||
|-
| <code>CAR(A,B,C)</code> || [[Corel R.A.V.E.]] ||
|-
| <code>IDF </code> || [[MIDI Instrument Definition File]] ||
|}

== Specifications ==
* [http://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf Multimedia Programming Interface and Data Specifications 1.0] - RIFF document issued jointly by IBM and Microsoft, 1991-08
* [http://netghost.narod.ru/gff/vendspec/micriff/ms_riff.txt Microsoft Multimedia Standards Update, Revision 1.0.97], 1992-07-29

== Software ==
* [http://www.schnarff.com/file-formats/riff/ RIFFPad]

== Links ==
* {{EGFF|riff|Microsoft RIFF File Format Summary}}, from the [[Encyclopedia of Graphics File Formats]]
* [[Wikipedia: Resource Interchange File Format]]
* [http://www.drdobbs.com/database/inside-the-riff-specification/184409308 Dr. Dobbs: Inside the RIFF Specification]
* [http://johnloomis.org/cpe102/asgn/asgn1/riff.html John S. Loomis: RIFF File Structure]

[[Category:RIFF based file formats]]
[[Category:Audio and Music]]
[[Category:Graphics]]
[[Category:Video]]
[[Category:Microsoft]]
[[Category:IBM]]

Imageiio/imaginfo (Ulead)

2022-07-12T16:39:17Z

J2j: add version identification for Imaginfo

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|pe3}}, {{ext|pe4}}
}}
'''imageiio.pe3''', '''imaginfo.pe3''', '''imageiio.pe4''', and '''imaginfo.pe4''' are the names of files that are auto-generated by some graphics applications from Ulead Systems. A pair of PE3 files, or of PE4 files, generally appears together. They presumably contain a thumbnail cache, and other indexing information.

Applications reported to create such files include iPhoto Plus, [[PhotoImpact]], and Photo Explorer.

== Identification ==
Some or all imageiio.pe3 files begin with ASCII "{{magic|IIO1$}}".

Some or all imageiio.pe4 files begin with ASCII "{{magic|IIO2H}}".

The imaginfo formats have no obvious signature. The version number such as three or four is stored in byte at offset 22.

== Sample files ==
* [https://archive.org/details/PI3CANON Ulead PhotoImpact 3.0] - CD image from archive.org (PE3 files)
* [https://archive.org/details/Ulead_Systems_iPhotoPlus_4_ULEAD_1996 Ulead Systems iPhotoPlus 4 (ULEAD) (1996)] - CD image from archive.org (PE4 files)
* https://telparia.com/fileFormatSamples/other/uleadImageiioThumbnailInfo/
* Or try searching the web for the relevant filenames.

== Links ==
* [[Wikipedia: Ulead Systems]]

[[Category:File formats with a distinctive filename]]
[[Category:Multi-file formats]]
[[Category:Ulead]]

Nickfile

2022-06-28T00:16:35Z

J2j: added software + replaced dead URLs

{{FormatInfo
|subcat=E-Mail, newsgroups, and forums
|extensions={{ext|nk2}}
}}
A [[Nickfile]] (NK2) is used by [[Microsoft Outlook]] to store e-mail aliases.

== File identification ==

Files begin with hex bytes <code>0D F0 AD BA</code>.

== Software ==
* [https://github.com/libyal/libnk2/ libnk2] - library to access the Microsoft Outlook Nickfile (NK2) format.
* [https://www.nirsoft.net/utils/outlook_nk2_edit.html NK2Edit] - Window tool to edit AutoComplete files of Microsoft Outlook.
* [https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec TestDisk] tool to recover/undelete Outlook files.

== Links ==
* [https://github.com/libyal/libnk2/blob/main/documentation/Nickfile%20(NK2)%20format.asciidoc Format specification (libnk2 project)]
* [https://fossies.org/linux/libpst/xml/MAPI_definitions.pdf MAPI definitions (libpst project)]
* [https://forensicswiki.xyz/wiki/index.php?title=Nickfile_(NK2) Forensic Wiki page]

[[Category:Microsoft]]

Outlook Express Database

2022-06-27T23:57:57Z

J2j: added + replaced dead URLs

{{FormatInfo
|subcat=E-Mail, newsgroups, and forums
|extensions={{ext|dbx}}
|pronom={{PRONOM|fmt/838}}, {{PRONOM|fmt/839}}
}}
An [[Outlook Express Database]] (DBX) is used by Microsoft Outlook Express (distinct from [[Microsoft Outlook|Outlook]]) to store e-mail messages and folders.

== File identification ==

Files begin with hex bytes {{magic|CF AD 12 FE}}.

This is followed by a class ID ([[CLSID]]) depending on whether the file contains messages or folders:

* Message Database: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4
* Folder Database: 6F74FDC6-E366-11d1-9A4E-00C04FA309D4
* Offline Database: 26FE9D30-1A8F-11D2-AABF-006097D474C4

== Links ==
* [http://www.forensicswiki.org/wiki/Outlook_Express_Database_%28DBX%29 Forensic Wiki page] [https://web.archive.org/web/20190311212311/www.forensicswiki.org/wiki/Outlook_Express_Database_(DBX) (archived)]
* [http://oedbx.aroh.de/ Downloadable file format info] [https://web.archive.org/web/20180307085639/http://oedbx.aroh.de/ (archived)]
* [http://sourceforge.net/projects/ol2mbox/ Outlook to Unix mail converter] (supports DBX via library libdbx among other Microsoft mail-related formats). Contains FILE-FORMAT for Outlook Express 5.0 DBX files
* [http://www.stellaroutlooktools.com/outlookexpress/dbx-pst.php DBX to PST converter]
* [https://sourceforge.net/projects/undbx/ undbx] tool to extract, recover and undelete e-mail messages from Outlook Express .dbx files.

[[Category:Microsoft]]

Transport Neutral Encapsulation Format

2022-06-15T01:18:09Z

J2j: added identification section, more sample files, more software

{{FormatInfo
|formattype=electronic
|subcat=E-Mail, newsgroups, and forums
|mimetypes={{mimetype|application/vnd.ms-tnef}}
|extensions={{ext|dat}}, {{ext|tnef}}
|wikidata={{wikidata|Q1601331}}
}}
'''Transport Neutral Encapsulation Format''' (TNEF) is a proprietary format used by Microsoft mail software to encode attachments and rich text, instead of more standards-compliant methods such as [[MIME]].

It is usually implemented as an attachment called '''winmail.dat''' or '''win.dat''', which Microsoft programs know what to do with, but is a useless and confusing attachment to everybody else (unless they use one of several programs and plugins that have been devised to help non-MS-ers cope with it). When saved elsewhere as archives or samples, sometimes the .tnef file extension is used.

== Identification ==
Such mail files start with signature bytes {{magic|0x78 0x9f 0x3e 0x22}}.

== Software ==
* [http://www.fentun.com/ Fentun]: Freeware Windows program to decode this attachment
* [http://sourceforge.net/projects/tnef/ TNEF]: An open source TNEF decoder utility
* [https://addons.mozilla.org/en-US/thunderbird/addon/lookout/ Lookout]: Thunderbird addon to read TNEF (based on the above TNEF decoder utility)
* [http://www.eolsoft.com/download/ Winmail Opener]
* [https://github.com/Yeraze/ytnef ytnef]: TNEF command-line extractor

== Sample files ==
* http://libxad.cvs.sourceforge.net/viewvc/libxad/testfiles/MS-TNEF/
* https://github.com/koodaamo/tnefparse/tree/master/tests/examples

== Links and references ==
* [[Wikipedia:Transport Neutral Encapsulation Format|Transport Neutral Encapsulation Format (Wikipedia)]]
* [http://www.modemhelp.net/newsletter/email/winmaildat.shtml How to turn off winmail.dat attachments]
* [https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef MS-TNEF format specifications]

[[Category:Microsoft]]
[[Category:File formats with a distinctive filename]]

Personal Folder File

2022-06-07T01:28:52Z

J2j: added Wikipedia URL + replaced dead URLs

{{FormatInfo
|subcat=E-Mail, newsgroups, and forums
|extensions={{ext|pab}}, {{ext|pst}}, {{ext|ost}}
|mimetypes={{mimetype|application/vnd.ms-outlook}}
|pronom={{PRONOM|x-fmt/75}}, {{PRONOM|x-fmt/248}}, {{PRONOM|x-fmt/249}}
}}
A [[Personal Folder File]] is used by [[Microsoft Outlook]] to store e-mails and other things. There are three varieties, which exist in 32 and 64 bit varieties:

* '''Personal Address Book''' (PAB) - stores contacts/address book entries
* '''Personal Storage Table''' (PST) - has mailboxes and other things such as tasks, notes, and appointments
* '''Offline Storage Table''' (OST) - is used for offline storage of items from a remote Exchange server

The name "Personal Folder File" actually originally applied to the PST variety, but has been used as an "umbrella" name for all the varieties as well.

== File identification ==

Files begin with hex bytes <code>21 42 44 4E</code>.

== Software ==

* [https://github.com/libyal/libpff libpff] - library + tools to access PFF and OFF (Offline Folder File) formats
* [http://www.five-ten-sg.com/libpst/ libpst] - includes utility to convert PST folders to both mbox and other formats

== Links ==
* [[Wikipedia: Personal Storage Table]]
* [https://googledrive.com/host/0B3fBvzttpiiScU9qcG5ScEZKZE0/Personal%20Folder%20File%20%28PFF%29%20format.pdf PFF format specification] (unofficial analysis) [https://web.archive.org/web/20151028083700/https://da1ba3cfdffc2404250f16d3711dfb32dcd40e96.googledrive.com/host/0B3fBvzttpiiScU9qcG5ScEZKZE0/Personal%20Folder%20File%20(PFF)%20format.pdf (archived)]
* [https://da1ba3cfdffc2404250f16d3711dfb32dcd40e96.googledrive.com/host/0B3fBvzttpiiScU9qcG5ScEZKZE0/PFF%20Forensics%20-%20analyzing%20the%20horrible%20reference%20file%20format.pdf Personal Folder File (PFF) forensics (Analyzing the horrible reference file format)] [https://web.archive.org/web/20160301184716/https://da1ba3cfdffc2404250f16d3711dfb32dcd40e96.googledrive.com/host/0B3fBvzttpiiScU9qcG5ScEZKZE0/PFF%20Forensics%20-%20analyzing%20the%20horrible%20reference%20file%20format.pdf (archived)]
* [http://msdn.microsoft.com/en-us/library/ff385210%28v=office.12%29.aspx PST file format (official Microsoft description)]
* [http://www.five-ten-sg.com/libpst/rn01re05.html PST file description]
* [http://www.forensicswiki.org/wiki/Personal_Folder_File_%28PAB,_PST,_OST%29 Forensics Wiki page] [https://web.archive.org/web/20190829130423/http://www.forensicswiki.org/wiki/Personal_Folder_File_(PAB,_PST,_OST) (archived)]
* [http://innovation-portal.dsitia.qld.gov.au/advice/1706/digital-public-records-outlook-calendars Digital Public Records - Outlook Calendars] (Queensland government challenge) 
* [https://web.archive.org/web/20210630214214/https://archive.codeplex.com/?p=pstsdk CodePlex PST SDK Archive]

[[Category:Microsoft]]
[[Category:Address books and contacts]]
[[Category:Calendars]]

Microsoft Compound File

2022-05-31T02:01:30Z

J2j: added Microsoft Access wizard template to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], [[Access|Microsoft Access]] wizard template, ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft Compound File

2022-05-30T03:07:29Z

J2j: added Microsoft Office Binder to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{59850400-6664-101B-B21C-00AA004BA90B}</code> || [[Microsoft Office]] Binder 
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft Office

2022-05-30T03:04:18Z

J2j: added URL for Microsoft Office tools

{{FormatInfo
|formattype=electronic
|subcat=Document
}}
'''Microsoft Office''' is Microsoft's flagship suite of office software. Its primary components are:
* '''Word''' (word processor) - See [[Microsoft Word]], [[DOC]], [[DOCX]], [[:Category:Microsoft Word]]
* '''Excel''' (spreadsheet) - See [[Microsoft Excel]], [[XLS]], [[XLSX]]
* '''PowerPoint''' (presentation) - See [[Microsoft PowerPoint]], [[PPT]], [[PPTX]]
* '''Outlook''' (personal information manager) - See [[Microsoft Outlook]]

== See also ==
* [[Access]]
* [[ActiveMime]]
* [[Microsoft Compound File]]
* [[Microsoft Office Drawing]]
* [[Microsoft Office File List]]
* [[Microsoft Works]]
* [[Office Open XML]]

== Links ==
* [[Wikipedia: Microsoft Office]]
* [[Wikipedia: Microsoft Office shared tools]]
* [http://msdn.microsoft.com/en-us/library/cc313118.aspx Microsoft Office File Formats] (msdn.microsoft.com)
* [http://decalage.info/file_formats_security/office File format security descriptions: Office]
* [http://blog.rootshell.be/2015/01/08/searching-for-microsoft-office-files-containing-macro/ Searching for Microsoft Office files containing macros]
* [http://www.hexacorn.com/blog/2016/11/05/office-macros-file-extensions-file-format-content-and-a-few-handling-stereotypes/ Office Macros – file extensions, file format (content), and a few handling stereotypes…]

[[Category:Microsoft]]
[[Category:Microsoft Word]]

Microsoft Compound File

2022-05-29T02:06:30Z

J2j: added Microsoft Powerpoint Addin/Wizard to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{817246F0-720A-11CF-8718-00AA0060263B}</code> || [[Microsoft PowerPoint]] Addin or Wizard 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

Microsoft PowerPoint

2022-05-29T01:59:02Z

J2j: add Powerpoint Wizard

{{FormatInfo
|formattype=electronic
|subcat=Document
|subcat2=Presentation
}}
:''This article is about the software, and all of its file formats. For the main PowerPoint file formats, see [[PPT]] and [[PPTX]].''

'''Microsoft PowerPoint''' is a presentation application. It is a component of the [[Microsoft Office]] suite.

There are separate articles for these PowerPoint formats:
* [[PPT]]
* [[PPTX]]

== Formats ==
{| class="wikitable"
! Format !! Version !! MIME type !! Ext. !! PRONOM !! Refer to
|-
|Microsoft Powerpoint Presentation || 4.0 ||rowspan="3"| {{mimetype|application/vnd.ms-powerpoint}} || .ppt || {{PRONOM|x-fmt/88}} ||rowspan="5"| [[PPT]]
|-
|Microsoft Powerpoint Presentation || 95 || .ppt || {{PRONOM|fmt/125}}
|-
|Microsoft Powerpoint Presentation || 97-2003 || .ppt || {{PRONOM|fmt/126}}
|-
|Microsoft PowerPoint for Macintosh || 4.0 || || .ppt || {{PRONOM|fmt/179}}
|-
|Microsoft PowerPoint for Macintosh || 2001 || || .ppt || {{PRONOM|fmt/181}}
|-
|Microsoft Powerpoint Design Template || || || .pot || {{PRONOM|x-fmt/84}} || [[PPT]]
|-
|Microsoft Powerpoint Packaged Presentation || || || .ppz || {{PRONOM|x-fmt/216}} ||
|-
|Microsoft Powerpoint Show || 97-2003 || || .pps || {{PRONOM|x-fmt/87}} || [[PPT]]
|-
|Microsoft PowerPoint Graphics File || || || .ppi || {{PRONOM|x-fmt/177}} ||
|-
|Microsoft Powerpoint Add-In || || || .ppa || {{PRONOM|x-fmt/86}} ||
|-
|Microsoft Powerpoint Wizard || 4.0-2004  || {{mimetype|application/vnd.ms-powerpoint}} || .pwz  || || [[Microsoft Compound File]]
|-
|Microsoft Powerpoint for Windows || 2007+ || {{mimetype|application/vnd.openxmlformats-officedocument.presentationml.presentation}} || .pptx || {{PRONOM|fmt/215}} || [[PPTX]]
|-
|Macro Enabled Microsoft Powerpoint || || {{mimetype|application/vnd.ms-powerpoint.presentation.macroEnabled.12}} || .pptm || {{PRONOM|fmt/487}} ||
|-
|Microsoft PowerPoint Template || 2007 || {{mimetype|application/vnd.openxmlformats-officedocument.presentationml.template}} || .potx || {{PRONOM|fmt/631}} ||
|-
|Microsoft PowerPoint Macro-Enabled Template || 2007 || {{mimetype|application/vnd.ms-powerpoint.template.macroEnabled.12}} || .potm || {{PRONOM|fmt/632}} ||
|-
|Microsoft PowerPoint Show || 2007 || {{mimetype|application/vnd.openxmlformats-officedocument.presentationml.slideshow}} || .ppsx || {{PRONOM|fmt/629}} ||
|-
|Microsoft PowerPoint Macro-Enabled Show || 2007 || {{mimetype|application/vnd.ms-powerpoint.slideshow.macroEnabled.12}} || .ppsm || {{PRONOM|fmt/630}} ||
|-
|Microsoft PowerPoint Macro-Enabled Slide || 2007 || {{mimetype|application/vnd.ms-powerpoint.slide.macroEnabled.12}} || .sldm || {{PRONOM|fmt/636}} ||
|-
|Microsoft PowerPoint Macro-Enabled Add-In || 2007 || {{mimetype|application/vnd.ms-powerpoint.addin.macroEnabled.12}} || .ppam || {{PRONOM|fmt/633}} ||
|}

== Links ==
* [[Wikipedia: Microsoft PowerPoint]]

[[Category:Microsoft]]

LoadDskF/SaveDskF

2022-05-19T03:09:08Z

J2j: Resources and more to Identification section

{{FormatInfo
|formattype=electronic
|subcat=Disk Image Formats
|extensions={{ext|dsk}}, {{ext|1dk}}, {{ext|2dk}}, ...
}}
'''LoadDskF''' and '''SaveDskF''' are floppy disk imaging utilities by IBM. They have an associated file format, sometimes called '''DSK''' or '''SKF'''. The format was notably used for OS/2 service packs.

It most likely contains an image of a [[FAT12]] filesystem.

Some files are compressed. The compression scheme is some form of [[LZW]].

== Format details ==
The LoadDskF documentation says "all diskette sectors are written [to the image file] up to and including the highest occupied data sector". So, uncompressed files can be converted to raw [[FAT]]/[[IMA]] format by deleting the header, and appending padding if needed.

=== File structure ===
The following information is from a [https://www.vcfed.org/forum/forum/technical-support/vintage-computer-software/13222-savedskf-exe-meaning-of-1-sector-leader#post183877 forum post].
<pre>
+0 DW magic [all words are in Intel little-endian order]
0x5AAA => Compressed
0x59AA => No compression
0x58AA => Older format (no compression), with sector data
beginning at fixed offset 0x200 rather than immediately
after the comment. Created by SAVEDSKF with the
undocumented /C option.

(In fact, LOADDSKF accepts any magic number in the range
58AAh-5AAAh, but these are the ones SAVEDSKF generates).

+2 DW media type
The first byte of the FAT.
+4 DW sector size, bytes
+6 DB cluster mask
The number of sectors per cluster, minus 1.
+7 DB cluster shift
= log2(cluster size / sector size)
+8 DW reserved sectors
As in the BIOS parameter block
+10 DB FAT copies
As in the BIOS parameter block
+11 DW Root directory entries
As in the BIOS parameter block
+13 DW Sector number of first cluster (ie, count of sectors used by boot
sector, FATs and root directory)
+15 DW Number of clusters in image. This is probably less than the number of
clusters the disc can hold, since empty clusters at the end are not
saved.
+17 DB sectors/FAT
As in the BIOS parameter block
+18 DW Sector number of root directory (ie, count of sectors used by
boot sector and FATs)
+20 DD checksum
Sum of all bytes in the file.
+24 DW cylinders
Number of cylinders, 40 or 80
+26 DW heads
Number of heads, 1 or 2
+28 DW sectors/track
Number of sectors per track
+30 DB 0,0,0,0
Do not appear to be used.
+34 DW number of sectors in image
+36 DW offset to comment
+38 DW offset to the first sector. If this is 0, assume it is 0x200.

After the header, an ASCII comment may follow.

The sectors then follow, stored in cylinder/head/sector order. If the magic
number is 5AAAh, the data will be compressed using a 12-bit LZW scheme.
</pre>

== Identification ==
Old format files start with bytes {{magic|0xaa 0x58}}.

New format uncompressed files start with {{magic|0xaa 0x59}}.

New format compressed files start with {{magic|0xaa 0x5a}}.

The value of the media descriptor byte is stored as 2 byte integer at offset two.
So the upper byte of the media type at offset 3 is not used and therefore always seems to contain the value 0.

The number of cylinders is stored as a 2-byte integer at offset 24.
Relatively small values appear here, with these often hovering around 40 or 80.
Since the mid-nineties there exist super floppy disks with a capacity of several hundred MB with a correspondingly large number of cylinders in the thousands.
Since the software for creating such disk images was designed for operation under DOS or OS/2 before that time,
you will not find such high cylinder values in real examples.

The number of heads is stored as a 2-byte integer at offset 26.
Only relatively small values like one or two appear here.

At offset 30 there are four bytes which are apparently not used and probably therefore always contain the value zero.

== Software ==
* [{{SACFTPURL|pack|diunpack.zip}} DIUNPACK Rel. 3.03] (1996-01-30) (OS/2 software)
* {{CdTextfiles|swextrav4/swextrav4-4/os2utilf/loaddf.zip|loaddf.zip}} - LoadDskF 1.16r (1993-01-14) and SaveDskF 1.14r (1992-05-26) - DOS and OS/2-compatible binaries; probably requires a floppy disk + drive.
* [http://www.os2site.com/sw/util/disk/floppy/dskxtr13.zip DSKXTRCT] - Exracts files (uncompressed disk images only) (OS/2 software)
* [http://www.os2site.com/sw/util/disk/floppy/dskdcmps.zip dskdcmps] - Decompresses compressed disk images (source code)
* {{Deark}} - Can convert to raw, decompress (based on dskdcmps), etc.
* {{CdTextfiles|swextrav4/swextrav4-4/os2utilf/makedskf.zip|MAKEDSKF}} - Utility for creating disk images (OS/2 software)
* [[7-Zip]]'s support for FAT is robust enough that it can often handle uncompressed LoadDskF files.

== Sample files ==
* {{CdTextfilesURL|hobbesos2/2_1/SERVPAK/}} - Old format
* https://archive.org/details/IBMOS22.11XR06200EnglishDiskettes → "IBM OS2 2.11 - XR06200 - English - Diskettes.zip" → *.DSK - Examples of new format, uncompressed
* https://archive.org/details/OS2_Install_Disks → OS2_W3B-D1CD_2000-03-19.zip → DISK1.DSK - Example of compressed format
* https://telparia.com/fileFormatSamples/archive/ibmSaveDsk/

==Resources==
* [[Wikipedia:Design of the FAT file system|Wikipedia - FAT file system]]

[[Category:IBM]]
[[Category:OS/2]]

XPM

2022-04-25T21:12:42Z

J2j: Identification and more unusual samples for other extensions added

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|xpm}}, {{ext|pm}}, {{ext|c}}, {{ext|h}}
|mimetypes={{mimetype|image/x-xpixmap}}
|pronom={{PRONOM|x-fmt/208}}
|wikidata={{wikidata|Q1887604}}
|released=1989
}}
'''X PixMap''' ('''XPM''') is an uncompressed raster image file format. It is essentially the color version of [[XBM]].

An XPM file is plain text. But some like the mentioned example <code>dframeIB.xpm</code> contain special characters like zero-byte or Control-Z at the end. These then no longer represent pure ASCII text, which leads to malfunction of some programs. Except for the little-used XPM version 2, it doubles as a fragment of [[C]] program code.
Therefore, instead of the usual extension xpm for the file name, you can also find the suffix h as in the example <code>progressui_gtk_icon.h</code>
or the suffix c as in the example <code>xpmputty.c</code>. In some cases these also contain other C expressions.
Unfortunately, this leads to some confusion.
On some systems, such examples are now considered as C header text or C source text based on the file extension.
When trying to edit them, they are usually opened with a text editor like Emacs or vi.
On other systems, however, the examples are viewed as X pixmap files based on the magic comment.
When trying to edit them, they are then usually opened with an image editor.

== Identification ==
X PixMap should start with 9 byte c-comment <code>/* XPM */</code>.
All start with a c-comment, but in some non-standard examples the magic comment appears several hundred bytes later, as in the examples <code>mozicon16.xpm</code> or <code>mozicon50.xpm</code>.
Or this comment is even completely missing as in the example <code>logo.xpm</code>.
Most programs cannot handle these variants, but some software like ImageMagick or IrfanView can.
Therefore, one should also check the part defined as C program code.
This begins with the two consecutive words static char, which are separated by white space.
This can be combinations of spaces and tabulation characters, but usually one space is used.
This string is often found a few thousand bytes after the beginning as in the example <code>mh-logo.xpm</code>.
The character array is defined without explicit length specification.
This can be recognized by the 2 byte sequence of square brackets <code>[]</code>.

== Specifications ==
* [http://www.x.org/docs/XPM/xpm.pdf XPM Manual: The X PixMap Format, Version 3.4i]

== Software ==
* [[Farbfeld Utilities]] (format 1, 2 (except Lisp mode), and 3)
* [[FFmpeg]]
* [[ImageMagick]] (format 3 only)
* [[Netpbm]]: ppmtoxpm, xpmtoppm (format 1 and 3)
* http://www.x.org/releases/individual/lib/ → libXpm-3.5.11.tar.gz
* [http://snisurset.net/code/abydos/ abydos]
* [[GIMP]]
* [http://www.irfanview.com/ IrfanView]
* [https://www.libreoffice.org/ LibreOffice Draw]
* [[XnView]]

== Sample files ==
* http://www.fileformat.info/format/xpm/sample/index.htm
* http://stuff.mit.edu/afs/athena/contrib/graphics/images/icons/
* https://telparia.com/fileFormatSamples/image/xpm/
* https://www.qemu.org/ - [https://download.qemu.org/qemu-7.0.0-rc4.tar.xz qemu-7.0.0-rc4.tar.xz] → logo.xpm
* http://ftp.mozilla.org/pub/thunderbird/ - [http://ftp.mozilla.org/pub/thunderbird/releases/60.5.3/source/thunderbird-60.5.3.source.tar.xz thunderbird-60.5.3.source.tar.xz] → mozicon16.xpm mozicon50.xpm
* https://archive.apache.org/dist/openoffice/ - [https://archive.apache.org/dist/openoffice/4.1.7/source/apache-openoffice-4.1.7-46059c9192-src.zip apache-openoffice-4.1.7-46059c9192-src.zip] → aoo-4.1.7/main/padmin/source/ psetupl.xpm
* http://raspbian.raspberrypi.org/ - [http://raspbian.raspberrypi.org/raspbian/pool/main/i/icewm-themes/icewm-themes_1.2.26.orig.tar.gz icewm-themes_1.2.26.orig.tar.gz] → icewm-themes-1.2.26/gnomeish/ dframeIB.xpm
* http://ftp.gnu.org/gnu/emacs/ - [http://ftp.gnu.org/gnu/emacs/emacs-28.1.tar.gz emacs-28.1.tar.gz] → emacs-28.1/etc/images/ mh-logo.xpm
* https://the.earth.li/~sgtatham/putty/0.76/ [https://the.earth.li/~sgtatham/putty/latest/putty-0.76.tar.gz putty-0.76.tar.gz] → putty-0.76/unix/ xpmputty.c
* https://www.libreoffice.org/download/download/ [https://download.documentfoundation.org/libreoffice/src/7.3.2/libreoffice-7.3.2.2.tar.xz libreoffice-7.3.2.2.tar.xz] → libreoffice-7.3.2.2/onlineupdate/source/update/updater/ progressui_gtk_icon.h

== External links ==
* {{EGFF|xpm|XPM File Format Summary}}, from the [[Encyclopedia of Graphics File Formats]]
* [http://www.w3.org/People/danield/xpm_story.html The XPM Story]
* [[Wikipedia:X PixMap|Wikipedia article]]

[[Category:X Window System]]

XPM

2022-04-22T02:00:47Z

J2j: mime type + more software and unusual samples added

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|xpm}}, {{ext|pm}}
|mimetypes={{mimetype|image/x-xpixmap}}
|pronom={{PRONOM|x-fmt/208}}
|wikidata={{wikidata|Q1887604}}
|released=1989
}}
'''X PixMap''' ('''XPM''') is an uncompressed raster image file format. It is essentially the color version of [[XBM]].

An XPM file is plain text. Except for the little-used XPM version 2, it doubles as a fragment of [[C]] program code.

== Specifications ==
* [http://www.x.org/docs/XPM/xpm.pdf XPM Manual: The X PixMap Format, Version 3.4i]

== Software ==
* [[Farbfeld Utilities]] (format 1, 2 (except Lisp mode), and 3)
* [[FFmpeg]]
* [[ImageMagick]] (format 3 only)
* [[Netpbm]]: ppmtoxpm, xpmtoppm (format 1 and 3)
* http://www.x.org/releases/individual/lib/ → libXpm-3.5.11.tar.gz
* [http://snisurset.net/code/abydos/ abydos]
* [[GIMP]]
* [http://www.irfanview.com/ IrfanView]
* [https://www.libreoffice.org/ LibreOffice Draw]
* [[XnView]]

== Sample files ==
* http://www.fileformat.info/format/xpm/sample/index.htm
* http://stuff.mit.edu/afs/athena/contrib/graphics/images/icons/
* https://telparia.com/fileFormatSamples/image/xpm/
* https://www.qemu.org/ - [https://download.qemu.org/qemu-7.0.0-rc4.tar.xz qemu-7.0.0-rc4.tar.xz] → logo.xpm
* http://ftp.mozilla.org/pub/thunderbird/ - [http://ftp.mozilla.org/pub/thunderbird/releases/60.5.3/source/thunderbird-60.5.3.source.tar.xz thunderbird-60.5.3.source.tar.xz] → mozicon16.xpm mozicon50.xpm
* https://archive.apache.org/dist/openoffice/ - [https://archive.apache.org/dist/openoffice/4.1.7/source/apache-openoffice-4.1.7-46059c9192-src.zip apache-openoffice-4.1.7-46059c9192-src.zip] → aoo-4.1.7/main/padmin/source/ psetupl.xpm
* http://raspbian.raspberrypi.org/ - [http://raspbian.raspberrypi.org/raspbian/pool/main/i/icewm-themes/icewm-themes_1.2.26.orig.tar.gz icewm-themes_1.2.26.orig.tar.gz] → icewm-themes-1.2.26/gnomeish/ dframeIB.xpm

== External links ==
* {{EGFF|xpm|XPM File Format Summary}}, from the [[Encyclopedia of Graphics File Formats]]
* [http://www.w3.org/People/danield/xpm_story.html The XPM Story]
* [[Wikipedia:X PixMap|Wikipedia article]]

[[Category:X Window System]]

Microsoft Compound File

2022-04-14T20:40:49Z

J2j: added Microsoft At Work Document + PageMaker to CLSID table

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable sortable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], [[PageMaker]], ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00022c44-0000-0000-c000-000000000046}</code> || [[Greenstreet_Publisher|GST DTP formats]]
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b01c80-e03d-101a-b294-00dd010f2bf9}</code> || [[AWD (At Work Document)|Microsoft fax At Work Document]]
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{31851f84-afe6-11d2-a3c9-00c04f72f340}</code> || [[Microsoft MapPoint]]
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || [[Microsoft Project]] 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

BIOS

2022-04-06T00:53:47Z

J2j: correct offset of jump instruction

{{FormatInfo
|formattype=electronic
|subcat=Firmware
|extensions={{ext|bin}}, {{ext|rom}}
}}
'''BIOS''' (Basic Input Output System), is a [[Read Only Memory|ROM]] chip containing code (firmware) to control peripherals attached to a [[wikipedia:PC]].

The x86 BIOS entry point is located at physical address <code>0xfffffff0</code> (usually corresponding to 16 bytes from the end of the BIOS image) and is executed in 16-bit real mode; it usually contains a jump instruction (either far or near). There are no other guarantees about BIOS image layout, although many vendors have developed in-house formats.

[[UEFI]] firmware images usually contain an embedded [[Firmware File System]].

== Identification ==
ROM images start with bytes {{magic|0xaa 0x55}}.
At offset 3 the initialization vector is stored.
In many cases this is a 3 byte jump instruction starting with hexadecimal value <code>0xE9</code>.
Images for cards with PCI interface contain a 4 byte signature <code>PCIR</code>.
Images for cards which support plug and Play feature contain a 4 byte signature <code>$PnP</code>.

== Sample files ==
* http://minuszerodegrees.net/rom/rom.htm - many older ROM images without Plug and Play.
* https://www.xtideuniversalbios.org/ - BIOS for IDE ATA hard disks.
* http://rayer.g6.cz/romos/romose.htm - <code>romos.bin</code> for loading FreeDOS.
* https://www.qemu.org/ - Download QEMU and extract or install → *.bin - ROM examples for cards with PCI interface.

== Links ==
* [[Wikipedia:Option ROM|Wikipedia article]]
* [http://www.coreboot.org/Bios_extract bios_extract]
* [http://bioshacking.blogspot.com/2012/02/bios-disassembly-ninjutsu-uncovered-1st.html BIOS Disassembly Ninjutsu Uncovered]

[[category:Low level instructions]]
[[Category:File format details]]
[[Category:Booting]]

BIOS

2022-04-06T00:40:42Z

J2j: add samples and identification section

{{FormatInfo
|formattype=electronic
|subcat=Firmware
|extensions={{ext|bin}}, {{ext|rom}}
}}
'''BIOS''' (Basic Input Output System), is a [[Read Only Memory|ROM]] chip containing code (firmware) to control peripherals attached to a [[wikipedia:PC]].

The x86 BIOS entry point is located at physical address <code>0xfffffff0</code> (usually corresponding to 16 bytes from the end of the BIOS image) and is executed in 16-bit real mode; it usually contains a jump instruction (either far or near). There are no other guarantees about BIOS image layout, although many vendors have developed in-house formats.

[[UEFI]] firmware images usually contain an embedded [[Firmware File System]].

== Identification ==
ROM images start with bytes {{magic|0xaa 0x55}}.
At offset 2 the initialization vector is stored.
In many cases this is a 3 byte jump instruction starting with hexadecimal value <code>0xE9</code>.
Images for cards with PCI interface contain a 4 byte signature <code>PCIR</code>.
Images for cards which support plug and Play feature contain a 4 byte signature <code>$PnP</code>.

== Sample files ==
* http://minuszerodegrees.net/rom/rom.htm - many older ROM images without Plug and Play.
* https://www.xtideuniversalbios.org/ - BIOS for IDE ATA hard disks.
* http://rayer.g6.cz/romos/romose.htm - <code>romos.bin</code> for loading FreeDOS.
* https://www.qemu.org/ - Download QEMU and extract or install → *.bin - ROM examples for cards with PCI interface.

== Links ==
* [[Wikipedia:Option ROM|Wikipedia article]]
* [http://www.coreboot.org/Bios_extract bios_extract]
* [http://bioshacking.blogspot.com/2012/02/bios-disassembly-ninjutsu-uncovered-1st.html BIOS Disassembly Ninjutsu Uncovered]

[[category:Low level instructions]]
[[Category:File format details]]
[[Category:Booting]]

Common Data Format

2022-03-04T16:11:02Z

J2j: added mime type + Wikipedia URL + samples URL + Identification

{{FormatInfo
|formattype=electronic
|subcat=Scientific Data formats
|extensions={{ext|cdf}}
|mimetypes={{mimetype|application/x-cdf}}
}}
The '''Common Data Format''' (CDF) is a file format and associated APIs designed by NASA for multi-dimensional datasets. It has largely been supplanted by the (mostly unrelated, except in name) [[netCDF]].

== Identification ==
The version 3 examples start with byte sequence <code>CD F3 00 01</code>, the middle ranged versions (2.6 and 2.7) begin with <code>CD F2 60 02</code> and
older versions 2.5 or earlier start with byte sequence <code>00 00 FF FF</code>.

== Specifications ==
* [http://cdf.gsfc.nasa.gov/ CDF Home Page] → [http://cdf.gsfc.nasa.gov/html/Version/V3500/CDF_docs.html Documentation] → [http://cdaweb.gsfc.nasa.gov/pub/software/cdf/doc/cdf350/cdf35ifd.pdf CDF Internal Formats Document]

== Software ==
* [http://cdf.gsfc.nasa.gov/ CDF Home Page] → [http://cdf.gsfc.nasa.gov/html/Version/V3500/sw_and_docs.html Download CDF Software] ...

== Sample files ==
* https://cdaweb.gsfc.nasa.gov/pub/software/cdf/cdf_test_files/

== Links ==
* [http://cdf.gsfc.nasa.gov/ CDF Home Page]
* [[Wikipedia:Common Data Format]]

WordPerfect

2021-09-03T20:34:38Z

J2j: newer version 7 and sample added

{{FormatInfo
|formattype=electronic
|subcat=Document
|subcat2=Word Processor
|extensions={{ext|wpd}}, {{ext|wp}}, {{ext|wp4}}, {{ext|wp5}}, {{ext|wp6}}, {{ext|wp7}}
|mimetypes={{mimetype|application/vnd.wordperfect}}
|pronom={{PRONOM|fmt/949}}, {{PRONOM|x-fmt/393}}, {{PRONOM|x-fmt/394}}, {{PRONOM|x-fmt/203}}, {{PRONOM|x-fmt/44}}, {{PRONOM|fmt/892}}, {{PRONOM|fmt/1220}}, {{PRONOM|fmt/1221}}, {{PRONOM|fmt/1222}}
|released=1979
|type code={{Type Code|WPD2}}, {{Type Code|WPD3}}, {{Type Code|WPD4}}
|wikidata={{wikidata|Q62664770}}, {{wikidata|Q61641450}}, {{wikidata|Q50308743}}, {{wikidata|Q73019664}}
}}
'''WordPerfect''' is a word processor that was extremely popular in the 1980s and 1990s. It was first developed on a Data General computer at Brigham Young University in 1979, but later ported to many different operating systems, and was most popular in its PC/MS-DOS version. Currently, only the Windows version is being developed and maintained, though WordPerfect never achieved the dominance in that platform that it had in DOS. For some reason, lawyers seem to have taken a particular liking to this program and its file format, and are among the small group of people still using it even now.

== Related formats ==
There are separate articles for these formats:
* [[WordPerfect Graphics]] (.wpg)
* [[WordPerfect macro]] (.wpm, .wcm)

==Introduction==
Name for both word processing application and file format.

==Printer definitions==
WordPerfect uses so called 'printer definitions' for "pretty printing".

==Detecting WordPerfect files==
The "signature bytes" at the beginning of a WordPerfect 5+ file are (hex) {{magic|FF 57 50 43}}, which spells "WPC" after a flag character #255.

Creator Code on Macintosh is "{{magic|WPC2}}"

===WordPerfect 4.2===
WordPerfect 4.2 use plain ascii with no magic header values.<ref>https://archive.org/download/wordperfectsdkperfectfit1994/WordPerfect_SDK_PerfectFit1994.iso/51PCSDK%2FWP42FF.TXT</ref>

WordPerfect 4.2 allows "locking" of the document which will require a password in order to open the file. Files having encryption created by WordPerfect 4.2 begin with the "{{magic|FEFF6161}}". See {{PRONOM|fmt/1424}} The method for encryption is fairly simple and can be quickly recovered.<ref>https://github.com/john-hern/wp_encrypt_crack</ref>

===WordPerfect 7===
Since version 7 WordPerfect can also store the documents using [[Microsoft_Compound_File|Microsoft OLE Compound file format]].<ref>https://github.com/OneWingedShark/WordPerfect/blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm</ref>
This is called "<code>WordPerfect Compound File</code>". The file name extension and mime type still remains the same like in previous versions.
OLE embedded objects are stored inside a storage called <code>PerfectOffice_OBJECT</code>, whereas the real document part is now stored as stream <code>PerfectOffice_MAIN</code>.
In principal the format of this internal document part is the same like in previous versions, but one difference is that the minor version number is raised from 1 to 2.

==Extracting plain-text content==
If you're a programmer attempting to get a program to extract the plain text out of a WordPerfect document, and are not interested in the fancy formatting and other features, this is a fairly simple process; just make the program skip the parts that are not text. When reading through the characters of the file in order, this pseudocode manipulates them (using decimal values of the characters/bytes):

For each character c, if its value is:
#128, #160: treat as space ' '
#169..#171, #173, #174: treat as dash '-'
#192..#236: skip ahead and ignore all characters until another occurrence
of character c is found; resume at the following character
#0..#31, #129..#159, #161..#168, #172, #175..#191, #237..#255: ignore (control characters)
else treat as regular text character

== Software ==
* [https://archive.org/details/apple_2_wordperfect_v1.1_for_iie_iic WordPerfect for the IIe and IIc Version 1.1 (1986)] (Internet Archive, with in-browser emulation)
* [https://archive.org/details/msdos_wordperfect6 WordPerfect 6.0 for MS-DOS] (Internet Archive in-browser emulation)
* [http://sourceforge.net/p/libwpd/wiki/writerperfect/ WordPerfect Document importer (writerperfect)]

==Developer utilities==
* [https://web.archive.org/web/20120125025312/http://apps.corel.com/partners_developers/csp/wordperfect_fileformatsdk.htm WordPerfect file format SDK] (archived version at Internet Archive, original pages have been taken offline)
* [https://archive.org/details/wordperfectsdkperfectfit1994 WordPerfect SDK CD-ROM circa 1994]
* [https://github.com/OneWingedShark/WordPerfect Repository with old SDK]
* libwpd - programmer library for dealing with WordPerfect files
** [http://libwpd.sourceforge.net/features.html Features]
** [http://sourceforge.net/projects/libwpd/ Document import]
** [http://sourceforge.net/projects/libwpg/ Graphics import]

== Sample files ==
* https://telparia.com/fileFormatSamples/document/wp/
* https://fossies.org/linux/wp2latex/test/ole6.wpd

==References==
* [[Wikipedia:WordPerfect|WordPerfect (Wikipedia)]]
* [https://www.wordperfect.com/en/product/office-suite/ WordPerfect Office website]
* [http://www.wpuniverse.com/ WPUniverse: forum devoted to WordPerfect]
<references/>

[[Category:Corel]]

Microsoft Compound File

2021-08-30T21:56:19Z

J2j: CLSID added for Microsoft Works portfolio *.WSB + WordPerfect document *.WPD

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{519873FF-2DAD-0220-1937-0000929679CD}</code> || [[WordPerfect]] document 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{6E26C7C0-8CB9-11D3-A1C8-00C04F612452}</code> || [[Microsoft Works]] portfolio 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || Microsoft Project 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Sample files ==
* https://telparia.com/fileFormatSamples/archive/msCompound/travel.gal

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

MAT

2021-07-30T01:27:35Z

J2j: Identification for level 7 and 4

{{FormatInfo
|formattype=electronic
|subcat=Scientific Data formats
|extensions={{ext|mat}}
|mimetypes={{mimetype|application/x-matlab-data}}
|pronom={{PRONOM|fmt/806}}, {{PRONOM|fmt/828}}
}}
'''MAT''' is a format used by Mathworks' [[Matlab]] for storing formatted data (matrices, structs, scalars and strings).

Apart from Matlab, the format is also supported by Mathematica. [https://www.gnu.org/software/octave/ GNU Octave], an open source alternative to Matlab, should be able to read and write the format as well. Scientific computing packages [http://numpy.scipy.org/ NumPy and SciPy] enable support for MAT-files in [[Python]].

== Versions ==
The [http://www.mathworks.com/help/pdf_doc/matlab/matfile_format.pdf published specification] makes a distinction between Level 4 and Level 5 MAT-files, where Level 4 files are compatible with older MATLAB versions (up to version 4), whereas level 5 files are compatible with MATLAB versions 5 and higher. The overall layout of a Level 4 file is quite different from Level 5, and the two might even be considered separate formats. For example, Level 4 files don't have a unique 'magic' byte pattern that would allow easy identification, whereas the header of a Level 5 file includes a descriptive text field that could be used for this.

[[Matlab_figure]] files are really just a special case of the level 5 MAT-File format.

== Identification ==
Level 5 files begin with the text string <code>MATLAB 5.0 MAT-file</code>.
Level 7 files begin with the text string <code>MATLAB 7.0 MAT-file</code>.
No such unique pattern exists for level 4.
At offset 12 the imaginary flag is stored as 4 byte integer.
If this is 1, the matrix contains an imaginary part.
If the matrix only contains real data, the value is 0.
Depending on the endian type, the byte at offset 12 or 15 has the value 0 or 1 and the three remaining bytes have the value 0.
So the two middle bytes have the value 0.
At offset 20 the matrix name is stored as null terminated ASCII string.
So the byte at this offset contains a character like a letter.
At offset 0 the type flag is stored as 4 byte integer.
In decimal that type integer is represented as <code>MOPT</code>, where <code>M</code> counts the thousands and indicates the numeric format of numbers on the machine.
Biggest possible value is 4052 (<code>0xFD4</code>). That means 2 upper bytes are always 0.
For big endian <code>M</code> value is 1. So lowest flag value is 1000 (<code>0x3E8</code>) and highest value is 1052 (<code>0x41C</code>).
The highest hexadecimal value with 4 as second byte occur for 16-bit and 8-bit integers.
For other number formats second byte has value 3.
For little endian machine <code>M</code> value is 0. That means highest type value is 52.
The MIME type of this format is unofficial, and it is used by [[Apache Tika]]

== Specification ==
* [http://www.mathworks.com/help/pdf_doc/matlab/matfile_format.pdf MAT-File Format Specification]

== Software ==
* [http://www.mathworks.com/matlabcentral/fileexchange/6893-matcat-mat-file-corruption-analysis-tool MATCAT - MAT-File Corruption Analysis Tool] (requires MATLAB)

== See also ==
* [[Matlab figure]]
* [[MATLAB script file]]

== Links ==
* [http://stackoverflow.com/questions/3947549/what-is-the-difference-between-m-and-mat-files-in-matlab What is the difference between .m and .mat files in MATLAB]
* [http://www.mathworks.com/help/matlab/import_export/mat-file-versions.html MAT file versions]
* [http://en.wikibooks.org/wiki/Octave_Programming_Tutorial/Saving_and_loading_a_MAT-file Saving and loading a MAT-file in GNU Octave]
* Writing Custom Applications to Read and Write MAT-Files [http://www.mathworks.se/help/matlab/matlab_external/custom-applications-to-read-and-write-mat-files.html here]

HDF

2021-07-05T15:45:59Z

J2j: URL to Wikipedia article added

{{FormatInfo
|formattype=electronic
|subcat=Scientific Data formats
|extensions={{ext|hdf}}, {{ext|h5}}
|mimetypes={{mimetype|application/x-hdf}}
}}

== Summary ==
The '''Hierarchical Data Format''' ('''HDF''') is a file format and associated APIs designed by the US NCSA for multi-dimensional datasets. Currently it has two main versions, [[HDF4]] and [[HDF5]], which are quite different in design, implementation, and API. Currently both are supported by the [http://www.hdfgroup.org/ HDF Group], but HDF5 is generally considered to be technically superior. Another widely-used data format, [[NetCDF]]-4, is based on HDF5.

== Software ==
* [[XnView]]
* [https://github.com/NanoComp/h5utils/ H5utils]

== Sample files ==
* https://telparia.com/fileFormatSamples/image/hdf4/
* https://telparia.com/fileFormatSamples/image/hdf5/

== Links ==
* [[Wikipedia:Hierarchical Data Format|Wikipedia: Hierarchical Data Format]]

TTCOMP

2021-06-29T18:02:47Z

J2j: software TTCOMP.EXE and blast added

{{FormatInfo
|formattype=electronic
|subcat=Compression
}}
'''TTComp archive''' is a compressed file format. It was apparently used by some software installation utilities. It uses [[PKWARE DCL Implode]] compression.

Though it may be called an "archive" format, it appears to store nothing more than a stream of compressed data.

== Identification ==
The first byte of a TTComp file indicates the type of compression:
* <code>0x00</code>: binary compression
* <code>0x01</code>: ASCII compression

The second byte of a TTComp file specifies the size of the dictionary as follows:
* <code>0x04</code>: 1024 bytes
* <code>0x05</code>: 2048 bytes
* <code>0x06</code>: 4096 bytes

Most TTComp files begin with bytes <code>0x00 0x06</code> indicating binary compression and a 4K dictionary.

== Software ==
* [http://www.exelana.com/techie/c/ttdecomp.html TTDecomp]
* [http://info.elf.stuba.sk/packages/pub/pc/pack/ttcomp.zip TTCOMP.EXE]
* [https://github.com/JoshVarga/blast blast]

== Sample files ==
* [https://archive.org/details/UniversalDialUPModemDriverCD Universal Dial UP Modem Driver CD] → SOFTWARE/BITWARE/.../*.??$
* https://telparia.com/fileFormatSamples/archive/ttcomp/

VBM (VDC BitMap)

2021-04-29T09:29:03Z

J2j: more software added like RECOIL

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|subcat2=Commodore graphics formats
|extensions={{ext|vbm}}, {{ext|bm}}
|released=≤1995
}}
'''VBM''' (VDC BitMap) is a bi-level raster image format associated with the ACE operating system for Commodore 64 and 128 computers. It was developed by Craig Bruce.

== Identification ==
VBM files begin with a signature of <code>'B' 'M' 0xCB</code>, followed by a 1-byte version number that is probably always either <code>0x02</code> or <code>0x03</code>. Note the similarity to the unrelated [[BMP|Windows BMP]] format.

== Specifications ==
* [http://csbruce.com/cbm/postings/csc19950906-1.txt Description of the VBM file format]

== Software ==
* [[Konvertor]]
* http://csbruce.com/cbm/ftp/unix/pbmtovbm.c
* [http://imageconverter.rest7.com/ Rest7 Online Image Converter]
* [[RECOIL]]
* [[Tom's Editor]]

== Sample files ==
* http://csbruce.com/cbm/ftp/images/vbm/
* http://www.commodore.ca/manuals/funet/cbm/c128/graphics/viewers/vbm/index-t.html
* https://telparia.com/fileFormatSamples/image/vbm/

== Links ==
* [http://www.godot64.de/english/l_vbm.htm GoDot: VBM loader]
* [http://csbruce.com/cbm/ace/ ACE]

FNT (Windows Font)

2021-01-24T01:00:37Z

J2j: samples + more software + identification

{{FormatInfo
|formattype=electronic
|subcat=Fonts
|extensions={{ext|fnt}}
}}
'''FNT''' is a mostly-obsolete bitmap or stroked (vector) font format associated with Microsoft Windows. FNT-format fonts are most commonly found inside [[Windows resource|resources]] of [[New Executable]] (sometimes [[Portable Executable]]) files, particularly in dedicated [[FON]] (<code>.fon</code>) files. They may also appear standalone (without a container), where they have the extension <code>.fnt</code>.

== Identification ==
Such fonts files begin with a nil-byte.
The next byte contains a value in range from one to three.
These two bytes corresponds to the version of the font file.
Then the file size is stored as 4 byte little endian value.
Since a font can contain a maximum of 255 characters and a few bytes are required per character description, this size is usually in the thousands area.
Since the file header already comprises more than 100 bytes, the size of a theoretically minimal FNT file with only one character is larger than hundred.
From offset 90 three properties of the font are saved in one byte each. These font properties are italic, underlined and strikeout.
If the font has the property in question, the corresponding value is one. Otherwise the value is zero.

== Software ==
* [http://www.seasip.info/Unix/PSF/ PSF Tools]
* [http://hukka.ncn.fi/fony/Fony-wip.zip Fony.exe] to edit Windows bitmap fonts in <code>FON</code>/<code>FNT</code> format.
* [https://www.chiark.greenend.org.uk/~sgtatham/fonts/mkwinfont mkwinfont]
* [https://www.chiark.greenend.org.uk/~sgtatham/fonts/dewinfont dewinfont]

== Sample files ==
* http://www.vsoft.nl/software/utils/win/fontedit/fontedit.zip → SAMPLE.FNT

== Links ==
* [http://support.microsoft.com/kb/65123 Windows Developers Notes: Font-File Format] - Covers versions 2 and 3 of the format.
* [http://www.os2museum.com/files/docs/win10sdk/windows-1.03-sdk-prgref-1986.pdf Windows 1.03 Programmer's Reference] (PDF) - Appendix C describes version 1 of the format.
* [https://msdn.microsoft.com/en-us/library/cc250412.aspx MSDN: CharacterSet Enumeration] - Codes used by the ''dfCharSet'' field
* [https://github.com/juanitogan/mkwinfont mkwinfont]

[[Category:Microsoft]]
[[Category:Windows]]

Windows Imaging Format

2021-01-04T20:38:26Z

J2j: ppkg extension

{{FormatInfo
|subcat=Archiving
|extensions={{ext|wim}}, {{ext|swm}}, {{ext|esd}}, {{ext|wim2}}, {{ext|ppkg}}
|mimetypes={{mimetype|application/x-ms-wim}}<ref>https://reposcope.com/mimetype/application/x-ms-wim</ref>
|pronom={{PRONOM|fmt/614}}
}}
The '''Windows Imaging Format''' is a file-based disk image format (as opposed to a [[Disk Image Formats|sector-based one]]) used to preserve and distribute a complete copy of a set of files with all its MS-Windows filesystem structure and metadata. It is created with the ImageX command line tool, part of the free Windows Automated Installation Kit (WAIK).
The file name extension <code>swm</code> is used for images splited into multiple parts.
The variant with the file name extension <code>esd</code> use <code>LZMS</code> compression.
Reconstruct.WIM2 is generated as second disk image by Microsoft's recovery drive creating tool <code>RecoveryDrive.exe</code>,
when the option to back up system files to the recovery drive is chosen.
<ref>https://www.tenforums.com/tutorials/4200-create-recovery-drive-windows-10-a.html</ref>
The <code>PPKG</code> file extension is used for Microsoft Windows provisioning packages.
<ref>https://deploymentresearch.com/beyond-basic-windows-10-provisioning-packages/</ref>

== Identification ==
WIM images begin with {{magic|MSWIM\0\0\0}} or {{magic|WLPWM\0\0\0}} for the wimlib pipable variant.<ref>https://wimlib.net/man1/wimcapture.html</ref>

== Software ==
* ImageX
* DISM part of the Windows Assessment and Deployment Kit
* [https://wimlib.net/ wimlib]
* [[7-Zip]]

== Links ==
* [[Wikipedia:Windows Imaging Format|Wikipedia article]]
* [http://technet.microsoft.com/en-us/library/dd799284%28v=ws.10%29.aspx Tech docs in Microsoft site]
* [http://www.microsoft.com/en-us/download/details.aspx?id=13096 White paper]

== References ==
<references/>

[[Category:Microsoft]]
[[Category:Windows]]

MIDI Instrument Definition File

2020-08-19T19:06:28Z

J2j: create MIDI Instrument Definition File

{{FormatInfo
|extensions={{ext|idf}}
|mimetypes={{mimetype|application/x-riff}}
|released=~1993
}}
A [[MIDI]] '''Instrument Definition File''' is a [[RIFF]] like container that remaps the General MIDI patch set and drum note assignments for a MIDI sound source that is not GM compliant.<ref>https://docs.isy.liu.se/pub/VanHeden/DataSheets/The_MIDI_Specification.pdf</ref>

== Identification ==
<code>.IDF</code> files start with ASCII "{{magic|RIFF}}", have "{{magic|IDF LIST}}" at offset 8, and {{magic|MMAPhdr }} at offset 20.
<ref>ftp://curscott.servebeer.com/Download/Apps/_Microsoft/Visual%20Studio%206.0%20Professional%20MSDN/SAMPLES/VC98/SDK/GRAPHICS/AUDIO/IDFEDIT/GLOBALS.H</ref>

== Software ==
* [ftp://ftp.fidobbs.net/pub/bbs/764/IDFEDIT.ZIP Microsoft's IDFedit Program]
* RIFFPad

== External links ==
* [[Wikipedia:MIDI]]
* [http://midi.teragonaudio.com/tutr/win95.htm#w3 Windows 95's MIDI Mapper]

== References ==
<references />

[[Category:File Format Identification]]
[[Category:RIFF based file formats]]
[[Category:Audio and Music]]

Windows Imaging Format

2020-08-11T01:14:44Z

J2j: esd wim2 extension + mime type + software

{{FormatInfo
|subcat=Archiving
|extensions={{ext|wim}}, {{ext|swm}}, {{ext|esd}}, {{ext|wim2}}
|mimetypes={{mimetype|application/x-ms-wim}}<ref>https://reposcope.com/mimetype/application/x-ms-wim</ref>
|pronom={{PRONOM|fmt/614}}
}}
The '''Windows Imaging Format''' is a file-based disk image format (as opposed to a [[Disk Image Formats|sector-based one]]) used to preserve and distribute a complete copy of a set of files with all its MS-Windows filesystem structure and metadata. It is created with the ImageX command line tool, part of the free Windows Automated Installation Kit (WAIK).
The file name extension <code>swm</code> is used for images splited into multiple parts.
The variant with the file name extension <code>esd</code> use <code>LZMS</code> compression.
Reconstruct.WIM2 is generated as second disk image by Microsoft's recovery drive creating tool <code>RecoveryDrive.exe</code>,
when the option to back up system files to the recovery drive is chosen.
<ref>https://www.tenforums.com/tutorials/4200-create-recovery-drive-windows-10-a.html</ref>

== Identification ==
WIM images begin with {{magic|MSWIM\0\0\0}} or {{magic|WLPWM\0\0\0}} for the wimlib pipable variant.<ref>https://wimlib.net/man1/wimcapture.html</ref>

== Software ==
* ImageX
* DISM part of the Windows Assessment and Deployment Kit
* [https://wimlib.net/ wimlib]
* [[7-Zip]]

== Links ==
* [[Wikipedia:Windows Imaging Format|Wikipedia article]]
* [http://technet.microsoft.com/en-us/library/dd799284%28v=ws.10%29.aspx Tech docs in Microsoft site]
* [http://www.microsoft.com/en-us/download/details.aspx?id=13096 White paper]

== References ==
<references/>

[[Category:Microsoft]]
[[Category:Windows]]

DOS device driver

2020-08-09T23:37:33Z

J2j: also BIN and DEV extension + examples

{{FormatInfo
| subcat = Executables
| extensions = {{ext|dos}}, {{ext|sys}}, {{ext|dev}}, {{ext|bin}}
}}
DOS device drivers (often simply known as '''SYS''' files) are stored in a simple binary format.
The filename extension <code>DEV</code> is used by the [[FreeDOS]] printer driver tool <code>SPOOL</code>.
For the block device driver of the compression software '''Stacker''',
which was also included in some versions of the '''DR-DOS''' operating system or the '''Novell DOS''' and '''Caldera OpenDOS''' offshoots,
the filename extension <code>BIN</code> is used.

Drivers are loaded into a contiguous block of memory; the segment part of data structure pointers is then adjusted to match the loading segment.

Some device drivers are stored in the [[MS-DOS EXE|MZ]] format instead of the "raw" SYS format.

== Identification ==
Most DOS device drivers begin with the magic ID {{magic|FF FF FF FF}}.

== See also ==
* [[FreeDOS]]

== Sample files ==
* http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/repositories/latest/util/spool.zip → SPOOL.DEV
* https://www.uwe-sieber.de/files/cfg_echo.zip → echo.sys
* http://ftp.uni-bayreuth.de/pc/caldera/DR-DOS.703/images/disk02.144 → STACLOAD.BIN

== Links ==
* [http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html SYS file structure in Ralf Brown's]

[[Category:MS-DOS]]

MSG (OS/2)

2020-07-25T12:00:53Z

J2j: OS/2 message files

{{FormatInfo
|formattype=electronic
|extensions={{ext|msg}}<ref>https://www.file-extensions.org/msg-file-extension-os-2-help-message</ref>
|mimetypes=
|released=~1986
}}

== Identification ==
Such OS/2 message files begin with "{{magic|0xFF}}", followed by "{{magic|MKMSG}}".
The next byte is {{magic|0x00}}.
At offset 16 version value 0 or 2 is stored as 2 byte little endian value.

== Software ==
* [http://www.os2site.com/sw/util/veit/e_msgf.arj e_msgf] From Veit Kannegieser produces source from <code>.MSG</code> files created by <code>MKMSGF</code>.
* [https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/ MKMSGF] clone

== Sample files ==
* http://www.os2site.com/sw/util/disk/boot/cdboot2v140.zip → CB2Gr.msg

== Links ==
* [[Wikipedia: OS/2]]

== References ==
<references />

[[Category:OS/2]]

RIFF

2020-07-14T00:11:56Z

J2j: TRID CDXA types added

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|locfdd={{LoCFDD|fdd000025}}
|released=1991
}}
The '''Resource Interchange File Format''' ('''RIFF'''), is a wrapper or container format, originally developed by Microsoft and IBM. Formats based on the RIFF container include the widely used [[WAV]] (audio) and [[AVI]] (video) formats.

It is similar to [[IFF]]. One difference is that RIFF uses little-endian [[Endianness|byte order]].

See also [[RIFX]].

== Identification ==
RIFF files begin with the ASCII characters "<code>RIFF</code>".

== RIFF type cross-reference ==
Selected "RIFF types", and related articles, are listed below. The RIFF type (also called "form type" or "RIFF form") is a [[FourCC|four-byte identifier]] that usually appears at file offset 8. See also [[:Category:RIFF based file formats]].

{| class="wikitable"
! RIFF type !! Refer to !! Remarks
|-
| <code>ACON</code> || [[Windows Animated Cursor]] ||
|-
| <code>AMV</code> || [[MTV Video (.AMV)]] ||
|-
| <code>AVI</code> || [[AVI]] ||
|-
| <code>BND</code> || [[RIFF Bundle File]] || Defined in the RIFF specifications.
|-
| <code>CDR?</code> || [[CorelDRAW]] ||
|-
| <code>CDXA</code> || [[MPEG-1]] || wrapped MPEG (CDXA)
|-
| <code>DES?</code> || [[Corel Designer]] ||
|-
| <code>PAL</code> || [[RIFF Palette File]] || Defined in the RIFF specifications.
|-
| <code>RDIB</code> || [[RDIB]] || Defined in the RIFF specifications.
|-
| <code>RMID</code> || [[RIFF MIDI]] || Defined in the RIFF specifications.
|-
| <code>RMMP</code> || [[RIFF Multimedia Movie]] ||
|-
| <code>TRID</code> || [[Trd (TRID)]] ||
|-
| <code>VDRM</code> || [[VDR (VirtualDub)]] ||
|-
| <code>WAVE</code> || [[WAV]] || Defined in the RIFF specifications.
|-
| <code>WEBP</code> || [[WebP]] ||
|-
| <code>sfbk</code> || [[SoundFont 2.0]] ||
|-
| <code>shw4</code> || [[SHW (Corel)]] ||
|-
| <code>MSFX</code> || [[RIFF MSFX]] || Appears to be meta info for .wav's
|-
| <code>MIDS</code> || [[RIFF MIDS]] ||
|-
| <code>STYL</code> || [[RIFF STYL]] ||
|}

== Specifications ==
* [http://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf Multimedia Programming Interface and Data Specifications 1.0] - RIFF document issued jointly by IBM and Microsoft, 1991-08
* [http://netghost.narod.ru/gff/vendspec/micriff/ms_riff.txt Microsoft Multimedia Standards Update, Revision 1.0.97], 1992-07-29

== Software ==
* [http://www.schnarff.com/file-formats/riff/ RIFFPad]

== Links ==
* {{EGFF|riff|Microsoft RIFF File Format Summary}}, from the [[Encyclopedia of Graphics File Formats]]
* [[Wikipedia: Resource Interchange File Format]]
* [http://www.drdobbs.com/database/inside-the-riff-specification/184409308 Dr. Dobbs: Inside the RIFF Specification]
* [http://johnloomis.org/cpe102/asgn/asgn1/riff.html John S. Loomis: RIFF File Structure]

[[Category:RIFF based file formats]]
[[Category:Audio and Music]]
[[Category:Graphics]]
[[Category:Video]]
[[Category:Microsoft]]
[[Category:IBM]]

Trd (TRID)

2020-07-14T00:07:26Z

J2j: correct trd extension instead tdr

{{FormatInfo
|extensions={{ext|trd}}
|mimetypes=
|released=~2003
}}
A <code>TRD</code> file is a [[RIFF]] like container that hold a serie of [[TrID]]'s definitions.
<code>TrIDDefs.TRD</code> is the default databases used by [[TrID]] file identification tool, if no other <code>TRD</code> database is given by <code>-d</code> option.

== Identification ==
.TDR files start with ASCII "{{magic|RIFF}}", have "{{magic|TRID}}" at offset 8, and {{magic|DEFN}} at offset 12.
<ref>http://mark0.net/download/triddefs_xml.7z → t → trd.trid.xml</ref>

== Software ==
* [[TrID]]

== Sample files ==
* https://mark0.net/download/triddefs.zip → TrIDDefs.TRD

== Links ==
* [https://mark0.net/soft-trid-e.html TrID website]

== References ==
<references />

[[Category:File Format Identification]]
[[Category:RIFF based file formats]]

Trd (TRID)

2020-07-14T00:04:06Z

J2j: TRID TRD database

{{FormatInfo
|extensions={{ext|tdr}}
|mimetypes=
|released=~2003
}}
A <code>TRD</code> file is a [[RIFF]] like container that hold a serie of [[TrID]]'s definitions.
<code>TrIDDefs.TRD</code> is the default databases used by [[TrID]] file identification tool, if no other <code>TRD</code> database is given by <code>-d</code> option.

== Identification ==
.TDR files start with ASCII "{{magic|RIFF}}", have "{{magic|TRID}}" at offset 8, and {{magic|DEFN}} at offset 12.
<ref>http://mark0.net/download/triddefs_xml.7z → t → trd.trid.xml</ref>

== Software ==
* [[TrID]]

== Sample files ==
* https://mark0.net/download/triddefs.zip → TrIDDefs.TRD

== Links ==
* [https://mark0.net/soft-trid-e.html TrID website]

== References ==
<references />

[[Category:File Format Identification]]
[[Category:RIFF based file formats]]

Windows Animated Cursor

2020-07-10T23:33:13Z

J2j: mime type + more software added

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|ani}}
|mimetypes={{mimetype|application/x-navi-animation}}<ref>https://reposcope.com/mimetype/application/x-navi-animation</ref>
|pronom={{PRONOM|fmt/386}}
}}
[[Windows Animated Cursor]] Format ('''ANI''') is an animated image format, mostly used for cursors (mouse pointer graphics) on Microsoft Windows.

== Format ==
ANI files use the [[RIFF]] container format. Individual frames can be encoded in [[ICO]] format, [[CUR]] format, or a "raw pixel data" format that does not seem to be fully documented.

== Identification ==
Files begin with <code>'R' 'I' 'F' 'F' ?? ?? ?? ?? 'A' 'C' 'O' 'N'</code>.

== Software ==
* {{Deark}}
* [[XnView]]
* [https://inkscape.org/ Inkscape]
* [http://www.irfanview.com/ IrfanView]

== Sample files ==
* http://cd.textfiles.com/desktopworks/CURSORS/
* http://www.anicursor.com/diercur.html
* http://www.angelfire.com/my/plinth/cursors.html
* https://telparia.com/fileFormatSamples/image/abydos/abydos.ani

== Links ==
* [https://web.archive.org/web/20130530192915/http://oreilly.com/www/centers/gff/formats/micriff GFF Format Summary: Microsoft RIFF] (from archive.org)
* [[Wikipedia:ANI %28file format%29|Wikipedia article]]

== References ==
<references/>

[[Category:RIFF based file formats]]
[[Category:Microsoft]]
[[Category:Windows]]
[[Category:Video]]

RIFF

2020-07-09T20:38:22Z

J2j: VDR sfbk DES types added

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|locfdd={{LoCFDD|fdd000025}}
|released=1991
}}
The '''Resource Interchange File Format''' ('''RIFF'''), is a wrapper or container format, originally developed by Microsoft and IBM. Formats based on the RIFF container include the widely used [[WAV]] (audio) and [[AVI]] (video) formats.

It is similar to [[IFF]]. One difference is that RIFF uses little-endian [[Endianness|byte order]].

See also [[RIFX]].

== Identification ==
RIFF files begin with the ASCII characters "<code>RIFF</code>".

== RIFF type cross-reference ==
Selected "RIFF types", and related articles, are listed below. The RIFF type (also called "form type" or "RIFF form") is a [[FourCC|four-byte identifier]] that usually appears at file offset 8. See also [[:Category:RIFF based file formats]].

{| class="wikitable"
! RIFF type !! Refer to !! Remarks
|-
| <code>ACON</code> || [[Windows Animated Cursor]] ||
|-
| <code>AMV</code> || [[MTV Video (.AMV)]] ||
|-
| <code>AVI</code> || [[AVI]] ||
|-
| <code>BND</code> || [[RIFF Bundle File]] || Defined in the RIFF specifications.
|-
| <code>CDR?</code> || [[CorelDRAW]] ||
|-
| <code>DES?</code> || [[Corel Designer]] ||
|-
| <code>PAL</code> || [[RIFF Palette File]] || Defined in the RIFF specifications.
|-
| <code>RDIB</code> || [[RDIB]] || Defined in the RIFF specifications.
|-
| <code>RMID</code> || [[RIFF MIDI]] || Defined in the RIFF specifications.
|-
| <code>RMMP</code> || [[RIFF Multimedia Movie]] ||
|-
| <code>VDRM</code> || [[VDR (VirtualDub)]] ||
|-
| <code>WAVE</code> || [[WAV]] || Defined in the RIFF specifications.
|-
| <code>WEBP</code> || [[WebP]] ||
|-
| <code>sfbk</code> || [[SoundFont 2.0]] ||
|-
| <code>shw4</code> || [[SHW (Corel)]] ||
|-
| <code>MSFX</code> || [[RIFF MSFX]] || Appears to be meta info for .wav's
|-
| <code>MIDS</code> || [[RIFF MIDS]] ||
|-
| <code>STYL</code> || [[RIFF STYL]] ||
|}

== Specifications ==
* [http://www.aelius.com/njh/wavemetatools/doc/riffmci.pdf Multimedia Programming Interface and Data Specifications 1.0] - RIFF document issued jointly by IBM and Microsoft, 1991-08
* [http://netghost.narod.ru/gff/vendspec/micriff/ms_riff.txt Microsoft Multimedia Standards Update, Revision 1.0.97], 1992-07-29

== Software ==
* [http://www.schnarff.com/file-formats/riff/ RIFFPad]

== Links ==
* {{EGFF|riff|Microsoft RIFF File Format Summary}}, from the [[Encyclopedia of Graphics File Formats]]
* [[Wikipedia: Resource Interchange File Format]]
* [http://www.drdobbs.com/database/inside-the-riff-specification/184409308 Dr. Dobbs: Inside the RIFF Specification]
* [http://johnloomis.org/cpe102/asgn/asgn1/riff.html John S. Loomis: RIFF File Structure]

[[Category:RIFF based file formats]]
[[Category:Audio and Music]]
[[Category:Graphics]]
[[Category:Video]]
[[Category:Microsoft]]
[[Category:IBM]]

VDR (VirtualDub)

2020-07-09T19:53:08Z

J2j: VDR (VirtualDub) created

{{FormatInfo
|subcat=Video
|extensions={{ext|vdr}}<ref>https://fileinfo.com/extension/vdr</ref>
|mimetypes=
|released=~2000
}}
'''VDR (VirtualDub)''' are created and used by VirtualDub, a program primarily used for editing <code>[[AVI]]</code> movie clips.
Such files are also called '''VirtualDub Signpost file''' or '''VirtualDub link handler'''.
The signpost file, which normally uses the .vdr filename extension, is used as input to the AVI capable client application and contains the frameserver name and video name. This video is then converted and offered by VirtualDub Frameserver to the client.

VDR files use the [[RIFF]] container format.

== Identification ==
.VDR files start with ASCII "{{magic|RIFF}}", have "{{magic|VDRM}}" at offset 8, and {{magic|PATH}} at offset 12.
At offset 20 the name of the used video is stored and at offset 16 the length of that name is stored.

== See also ==
* [[Video]]

== Software ==
* [http://www.virtualdub.org/ VirtualDub]

== Links ==
* [[Wikipedia: VirtualDub]]

== References ==
<references/>

[[Category:RIFF based file formats]]

Corel Gallery

2020-06-28T19:45:17Z

J2j: precise BMF file identification + OLE samples

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|bmf}}, {{ext|gal}}
|released=1993
}}
'''Corel Gallery''' was a vector clipart product released by Corel around 1993-94. The first version came loaded with 10,000 clipart files in the BMF format on the PC and the [[PICT]] format on the Macintosh. The proprietary BMF format meant you had to use the included Gallery software to then copy & paste into other applications or export into another format for use in your other documents. Later versions of Gallery used [[CCX (Corel)|.CCX]] or [[CMX|.CMX]] for the ClipArt format.<ref>https://web.archive.org/web/20001005011336/http://kb.corel.com/kbdocs/MISC/CLIPARTGALLERIESWIN/CLIPARTGALLERIESWIN_101559.htm</ref>

There are some references alleging the format is a Corel Flow image format, but no evidence to support. Also not to be confused with [[BMF|other formats named BMF]].

It's not clear what BMF stands for. Some format lists say ''Binary Material Format'', but that does not seem plausible.

Starting in Gallery 2, Corel used a .GAL format to reference groups of ClipArt. This [[Microsoft Compound File|OLE]] container referenced multiple .CMX or .CCX files and their thumbnails.

==File Identification==

BMF files headers all begin with ascii "{{magic|@CorelBMF\n\rCorel Corporation}}".
In the OLE-based format, the first three directory entry names are often <code>_ITEM_</code>, <code>_DATA_</code> and <code>_INFO_</code>.
The names <code>_ALBUM_</code> and <code>_THUMBNAIL_</code> follow later.

== Sample files ==
* [https://archive.org/details/corel-art-show-6-1995 ArtShow 6] GAL examples found in '''ALBUMS''' subdirectry of '''ARTSHOW6''' directory.

==Software==
* [https://archive.org/details/Corel_Gallery_10000_Cliparts_for_Win31 Gallery Software and Sample files]
* [https://archive.org/details/cg1000000disk01 Gallery 3 Software and Sample files]
* [[XnView]] (can display the BMF preview image)
* [http://www.mitec.cz/ssv.html Structured Storage Viewer] (can display structure and elements of OLE based gallery)

==Links==
* [https://web.archive.org/web/19961219042623/http://www.corel.com/products/clipartandphotos/gallery1forpc/index.htm Corel GALLERY™ for Windows® (archived)]
* [https://www.filedesc.com/en/file/bmf BMF Description]
* [https://books.google.com/books?id=hDgEAAAAMBAJ&lpg=PA129&ots=SApe3kdXjG&dq=%22corel%20gallery%22&pg=PA129#v=onepage&q=%22corel%20gallery%22&f=false InfoWorld May 2, 1994]
* [https://twitter.com/Clipart1994bot Twitter Gallery 1994 feed]
* [https://web.archive.org/web/19961219021934/http://www.corel.com/news/1995/march/march6.htm Corel Ships Corel GALLERY 2]
* [https://web.archive.org/web/19990203013033/http://www.corel.com/news/1998/august/1million.htm Corel First to Market with One Million Images (Gallery 3)]

== References ==
<references/>

[[Category:Corel]]
[[Category:Microsoft Compound File]]

Corel Gallery

2020-06-27T21:40:56Z

J2j: OLE based file identification + SSViewer software

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|bmf}}, {{ext|gal}}
|released=1993
}}
'''Corel Gallery''' was a vector clipart product released by Corel around 1993-94. The first version came loaded with 10,000 clipart files in the BMF format on the PC and the [[PICT]] format on the Macintosh. The proprietary BMF format meant you had to use the included Gallery software to then copy & paste into other applications or export into another format for use in your other documents. Later versions of Gallery used [[CCX (Corel)|.CCX]] or [[CMX|.CMX]] for the ClipArt format.<ref>https://web.archive.org/web/20001005011336/http://kb.corel.com/kbdocs/MISC/CLIPARTGALLERIESWIN/CLIPARTGALLERIESWIN_101559.htm</ref>

There are some references alleging the format is a Corel Flow image format, but no evidence to support. Also not to be confused with [[BMF|other formats named BMF]].

It's not clear what BMF stands for. Some format lists say ''Binary Material Format'', but that does not seem plausible.

Starting in Gallery 2, Corel used a .GAL format to reference groups of ClipArt. This [[Microsoft Compound File|OLE]] container referenced multiple .CMX or .CCX files and their thumbnails.

==File Identification==

BMF files headers all begin with ascii "{{magic|@CorelBMF Corel Corporation}}".
In the OLE-based format, the first three directory entry names are often <code>_ITEM_</code>, <code>_DATA_</code> and <code>_INFO_</code>.
The names <code>_ALBUM_</code> and <code>_THUMBNAIL_</code> follow later.

==Software==
* [https://archive.org/details/Corel_Gallery_10000_Cliparts_for_Win31 Gallery Software and Sample files]
* [https://archive.org/details/cg1000000disk01 Gallery 3 Software and Sample files]
* [[XnView]] (can display the BMF preview image)
* [http://www.mitec.cz/ssv.html Structured Storage Viewer] (can display structure and elements of OLE based gallery)

==Links==
* [https://web.archive.org/web/19961219042623/http://www.corel.com/products/clipartandphotos/gallery1forpc/index.htm Corel GALLERY™ for Windows® (archived)]
* [https://www.filedesc.com/en/file/bmf BMF Description]
* [https://books.google.com/books?id=hDgEAAAAMBAJ&lpg=PA129&ots=SApe3kdXjG&dq=%22corel%20gallery%22&pg=PA129#v=onepage&q=%22corel%20gallery%22&f=false InfoWorld May 2, 1994]
* [https://twitter.com/Clipart1994bot Twitter Gallery 1994 feed]
* [https://web.archive.org/web/19961219021934/http://www.corel.com/news/1995/march/march6.htm Corel Ships Corel GALLERY 2]
* [https://web.archive.org/web/19990203013033/http://www.corel.com/news/1998/august/1million.htm Corel First to Market with One Million Images (Gallery 3)]

== References ==
<references/>

[[Category:Corel]]
[[Category:Microsoft Compound File]]

Corel Designer

2020-06-24T23:18:25Z

J2j: root.dat since version 16

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|des}}
|mimetypes={{mimetype|application/x-vnd.corel.designer.document+zip}}, {{mimetype|application/x-vnd.corel.zcf.designer.document+zip}}
|released=2003
}}
'''Corel Designer''' is a engineering and graphic design application which belongs to the Corel Draw Technical Suite. Originally [[Micrografx Draw]], Corel purchased in 2001.

==File Identification==

Corel Designer 9 was Micrografx last release, Designer 10-12 was based on the [[RIFF]] format, while X4-onward is based on [[ZIP]]/[[XML]] format with X4-X6 wrapped around a <code>[[CorelDRAW|.CDR]]</code>. This begins with the characteristic local ZIP file header signature <code>PK</code>. The first archive member is an uncompressed file named <code>mimetype</code>. This 8-byte string is therefore also found at offset 30. The content of this file specifies the mime type of the corresponding Corel Designer graphic. From version 17 this type is <code>application/x-vnd.corel.zcf.designer.document+zip</code>. For older ZIP based versions this type is <code>application/x-vnd.corel.designer.document+zip</code>. Therefore we find this 49 or 45 byte long string at offset 38 in the ZIP archive. Starting with version 16, the RIFF based part is stored in a file named <code>root.dat</code>. For older ZIP based versions the corresponding file is called <code>riffData.cdr</code>. These files are stored in a folder called <code>content</code> in the archive. [[PRONOM]] binary signatures needed.

{| class="wikitable"
! Format / Version !! Ext. !! RIFF type !! PRONOM !! Year
|-
|Designer 9.0 || .dsf || n/a || {{PRONOM|x-fmt/151}} || 2002
|-
|Designer 10.0 || .des || <code>DESA</code> || || 2003
|-
|Designer 10.5 || .des || <code>DESB</code> || ||
|-
|Designer 12.0 || .des || <code>DESC</code> || || 2006
|-
|Designer X4 || .des || <code>DESE</code> || || 2008
|-
|Designer X5 || .des || <code>DESF</code> || || 2010
|-
|Designer 16 || .des || <code>DESG</code> || || 2013
|-
|Designer 17 || .des || <code>DESH</code> || || 2014
|-
|Designer 19 || .des || <code>DESI</code> || || 2017
|-
|Designer 20 || .des || <code>DESJ</code> || || 2018
|-
|Designer 21 || .des || <code>DESK</code> || || 2019
|}

==Links==
* [[Wikipedia: Corel_Designer]]
* [https://www.coreldraw.com/en/pages/old-brands/micrografx/ Looking for Micrografx?]

[[Category:Corel]]
[[Category:RIFF based file formats]]
[[Category:XML based file formats]]
[[Category:ZIP based file formats]]

Corel Photo-Paint image

2020-06-22T09:18:45Z

J2j: Link to sample files added

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|cpt}}
|pronom={{PRONOM|x-fmt/144}}
|released=1992
}}
'''Corel Photo-Paint image''' (CPT) is the native format of the Corel Photo-Paint program, though this program also supports some other, more widely-used formats. It is apparently a different program from [[Ability Office PhotoPaint]], though they both seem to be intended as replacements for [[Adobe Photoshop]], and support the [[PSD]] format among others.

The CPT format is a multi-layer bitmap with additional information stored. There are several versions, with considerable differences. An online document referred to as "CPT file format specification" is not to be an official spec (it contains comment "Zajebiście tajemnicze pole :-P" which translates from Polish as "Awesomly mysterious field :-P"), but rather an attempt to describe the format (most likely by reverse-engineering), and is incomplete (with lots of "TODO" notes).

It usually (always?) contains a thumbnail. Both image and thumbnail are compressed.

== Format description ==
* [http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf Draft spec v0.01]

== See also ==
* [[Corel Gallery]]

== Sample files ==
* [https://archive.org/details/cg1000000disk01 Gallery 3 Software and CPT samples in directory IMGLISTS]

== Other links ==
* [[Wikipedia:Corel Photo-Paint|Wikipedia article]]
* [http://www.corel.com/ Corel site]

[[Category:Corel]]

Microsoft Compound File

2020-06-18T19:59:35Z

J2j: CLSID added for Microsoft Visio, Works, Project, Windows Installer Patch; more DOC PPT; WordPerfect Presentation, Graphic; StarOffice

{{FormatInfo
|formattype=electronic
|subcat=Metaformats
|thiscat=Microsoft Compound File
|locfdd={{LoCFDD|fdd000380}}, {{LoCFDD|fdd000392}}
|pronom={{PRONOM|fmt/111}}
}}
:''"OLE" redirects here. See also [[OLE 1.0 object]].''

'''Microsoft Compound File''' is a complex container format used by some versions of [[Microsoft Office]], and other Windows-centric applications. It has features similar to those of a [[filesystem]] format.

Its name has many variations, including:
* '''Compound File Binary File Format''' ('''CFBF''' or '''CFB''')
* '''Microsoft Compound Document File Format'''
* '''OLE Compound Document Format'''
* '''OLE2 Compound Document Format'''
* '''Composite Document File'''
* '''DocFile'''

The format was not publicly documented by Microsoft until 2008.

It is (or was?) unofficially known as ''LAOLA File Format''.

== Identification ==
Files begin with signature bytes {{magic|D0 CF 11 E0 A1 B1 1A E1}}.

Identifying the specific document type can be difficult. Some, but not all, document types can be identified by the [[CLSID]] field in the "root storage" directory entry. This field is usually located at file offset 512×(1 + {the 32-bit integer at offset 48}) + 80.

Some files have a stream named "<code><U+0005>SummaryInformation</code>" containing metadata, which may include information about the creating application.

=== Root storage object CLSIDs ===
The table below lists some of the root storage object CLSIDs that have been observed in this type of file. Use this information at your own risk, as these identifiers can be unreliable.

Microsoft's documentation says this about the CLSID field:

<blockquote>This field contains an object class GUID. [...] If not [all zeroes], the object class GUID can be used as a parameter to start applications.</blockquote>

Although every ''storage object'' (think ''subdirectory'') can have a CLSID, this table is only concerned with the file's ''root'' storage object.

Note that the CLSIDs are stored as [[GUID]]s in little-endian binary format, so they have a strange byte order.

{| class="wikitable"
! Root storage object CLSID !! Format
|-
|<code>{00000000-0000-0000-0000-000000000000}</code> || Unspecified (could be [[Windows thumbnail cache|Thumbs.db]], [[Visual Studio Solution Options file|SUO]], ...)
|-
|<code>{00020810-0000-0000-c000-000000000046}</code> || [[XLS|Excel 5-95 XLS]] 
|-
|<code>{00020820-0000-0000-c000-000000000046}</code> || [[XLS|Excel 97-2003 XLS]] 
|-
|<code>{00021302-0000-0000-c000-000000000046}</code> || [[Microsoft Works Word Processor|Microsoft Works 3-4 WordProcessor]] 
|-
|<code>{00021303-0000-0000-c000-000000000046}</code> || [[Microsoft Works Database|Microsoft Works 3-4 database]]
|-
|<code>{00020900-0000-0000-c000-000000000046}</code> || [[DOC|Word 6-95 DOC]]
|-
|<code>{00020906-0000-0000-c000-000000000046}</code> || [[DOC]] 
|-
|<code>{00020d0b-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item File]] 
|-
|<code>{00021201-0000-0000-00c0-000000000046}</code> || [[Microsoft Publisher]]
|-
|<code>{00021a13-0000-0000-c000-000000000046}</code> || [[Visio]] 2000-2002
|-
|<code>{00021a14-0000-0000-c000-000000000046}</code> || [[Visio]] 2003-2010
|-
|<code>{00044851-0000-0000-c000-000000000046}</code> || [[PPT|PowerPoint 4.0 PPT]] 
|-
|<code>{0006f046-0000-0000-c000-000000000046}</code> || [[Outlook Item File|Outlook 97-2003 Item template]] 
|-
|<code>{000c1084-0000-0000-c000-000000000046}</code> || [[Windows Installer|MSI]]
|-
|<code>{000c1086-0000-0000-c000-000000000046}</code> || [[Windows Installer|Windows Installer Patch MSP]]
|-
|<code>{012d3cc0-4216-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 4.0]] 
|-
|<code>{02b3b7e0-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 4.0]] 
|-
|<code>{02b3b7e1-4225-11d0-89ca-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 4.0]] 
|-
|<code>{0ea45ab2-9e0a-11d1-a407-00c04fb932ba}</code> || [[Microsoft Works Word Processor|Microsoft Works 5-6 WordProcessor]] 
|-
|<code>{1cdd8c7b-81c0-45a0-9fed-04143144cc1e}</code> || [[MAX (3ds Max)]]
|-
|<code>{18b8d021-b4fd-11d0-a97e-00a0c905410d}</code> || [[MIX (PhotoDraw)]]
|-
|<code>{28cddbc2-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Word Processor|Microsoft Works 4 WordProcessor]] 
|-
|<code>{28cddbc3-0ae2-11ce-a29a-00aa004a1a72}</code> || [[Microsoft Works Database|Microsoft Works 4 database]] 
|-
|<code>{2e8905a0-85bd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarDraw 5.0]] 
|-
|<code>{340ac970-e30d-11d0-a53f-00a0249d57b1}</code> || [[StarOffice binary formats|Master 4.0]] 
|-
|<code>{3f543fa0-b6a6-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarCalc 3.0]] 
|-
|<code>{402efe60-1999-101b-99ae-04021c007002}</code> || [[WordPerfect_Graphics|WordPerfect 9 Graphic ]] 
|-
|<code>{402efe62-1999-101b-99ae-04021c007002}</code> || [[SHW_(Corel)|Corel 7-X3 presentation]] 
|-
|<code>{565c7221-85bc-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarImpress 5.0]] 
|-
|<code>{56616700-c154-11ce-8553-00aa00a1f95b}</code> || [[FlashPix]]
|-
|<code>{56616800-c154-11ce-8553-00aa00a1f95b}</code> || [[MIX (PhotoDraw)]] or [[MIX (Picture It!)]]
|-
|<code>{6361d441-4235-11d0-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 4.0]] 
|-
|<code>{64818d10-4f9b-11cf-86ea-00aa00b929e8}</code> || [[PPT]] 
|-
|<code>{74b78f3a-c8c8-11d1-be11-00c04fb6faf1}</code> || Microsoft Project 
|-
|<code>{8b04e9b0-420e-11d0-a45e-00a0249d57b1}</code> || [[StarOffice binary formats|StarWriter 4.0]] 
|-
|<code>{af10aae0-b36d-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarDraw 3.0]] 
|-
|<code>{bf884321-85dd-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarChart 5.0]] 
|-
|<code>{c20cf9d1-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|StarWriter 5.0]] 
|-
|<code>{c20cf9d3-85ae-11d1-aab4-006097da561a}</code> || [[StarOffice binary formats|Master 5.0]] 
|-
|<code>{c65e63e1-6c0e-11cf-842e-00aa006130ba}</code> || [[Softimage SCN]]
|-
|<code>{c6a5b861-85d6-11d1-89cb-008029e4b0b1}</code> || [[StarOffice binary formats|StarCalc 5.0]] 
|-
|<code>{d4590460-35fd-101c-b12a-04021c007002}</code> || [[StarOffice binary formats|StarMath 3.0]] 
|-
|<code>{dc5c7e40-b35c-101b-9961-04021c007002}</code> || [[StarOffice binary formats|StarWriter 3.0]] 
|-
|<code>{ea7bae70-fb3b-11cd-a903-00aa00510ea3}</code> || [[PPT|PowerPoint 95 PPT]] 
|-
|<code>{fb9c99e0-2c6d-101c-8e2c-00001b4cc711}</code> || [[StarOffice binary formats|StarChart 3.0]] 
|-
|<code>{ffb5e640-85de-11d1-89d0-008029e4b0b1}</code> || [[StarOffice binary formats|StarMath 5.0]] 
|-
|}

== Related formats ==
* [[OLE Property Set]]

For formats based on this format, see [[:Category:Microsoft Compound File]].

== Specifications ==
* [https://msdn.microsoft.com/en-us/library/dd942138.aspx MSDN: Compound File Binary File Format] → [MS-CFB] PDF
* [https://www.openoffice.org/sc/compdocfileformat.pdf OpenOffice.org's documentation]

== Programs, libraries, and utilities ==
* [http://www.mitec.cz/ssv.html Structured Storage Viewer]
* [https://github.com/libyal/libolecf/wiki libolecf]
* [http://www.decalage.info/python/olefileio OleFileIO_PL - a Python module to read MS OLE2 files]
* [http://videos.didierstevens.com/2014/08/26/oledump-py-beta/ oledump.py beta]
* [https://github.com/unixfreak0037/officeparser officeparser]
* [http://decalage.info/python/oletools python-oletools - python tools to analyze OLE files]
* [https://sourceforge.net/projects/openmcdf/ OpenMCDF]
* [https://poi.apache.org/ Apache POI] - Java API for Microsoft documents
* [https://github.com/renyxa/re-lab Re-lab / OLE Toy]
* [[7-Zip]]

== Links ==
* [[Wikipedia:Compound File Binary Format|Wikipedia article]]
* [http://www.forensicswiki.org/wiki/OLE_Compound_File Forensics Wiki article]
* [http://www.joelonsoftware.com/items/2008/02/19.html Joel on Software: Why are the Microsoft Office file formats so complicated?]
* Some (older) reverse engineered information [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/guide.html here] and a Perl module [http://stuff.mit.edu/afs/athena/astaff/project/mimeutils/share/laola/laola.pl here]
* [http://blog.avira.com/malicious-office-macros-dead/ Malicious Office macros are not dead]
* [http://decalage.info/file_formats_security/office MS Office 97-2003 legacy/binary formats security] - article with lots of resources on MS Office formats, including analysis techniques, tools and parsing libraries
* [https://msdn.microsoft.com/en-us/library/aa295067(v=vs.60).aspx MSDN: Providing Summary Information]

[[Category:Document]]
[[Category:Microsoft]]

CorelDRAW

2020-06-14T20:13:26Z

J2j: Symbol Library *.csl added

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|cdr}}, {{ext|cdt}}, {{ext|cdx}}, {{ext|cpx}}, {{ext|csl}} ,{{ext|pat}}
|pronom={{PRONOM|fmt/430}}, others
}}
'''CorelDRAW''' is a vector graphics drawing program. Its native file format is generally found in .cdr files, but other extensions exist for variants of it. The format has gone through several major revisions over the years.

== Identifiers ==

* '''.cdr''': Normal CorelDRAW file
* '''.cdt''': Template
* '''.cdx''': Compressed file
* '''.cmx''': [[CMX|Corel Presentation Exchange Format]]
* '''.ccx''': Compressed .cmx; see [[CCX (Corel)]]
* '''.cpx''': Corel Presentation Exchange Compressed Format (?)
* '''.csl''': Corel Symbol Library

{| class="wikitable"
! Format / Version !! Ext. !! RIFF type !! PRONOM !! Filter ID !! Remarks
|-
|Drawing 1.0 ||rowspan="17"| .cdr || n/a || {{PRONOM|fmt/467}} ||
|-
|Drawing 2.0 || n/a || {{PRONOM|fmt/466}} ||
|-
|Drawing 3.0 || <code>CDR</code> || {{PRONOM|x-fmt/379}} ||
|-
|Drawing 4.0 || <code>CDR4</code> || {{PRONOM|fmt/465}} ||
|-
|Drawing 5.0 || <code>CDR5</code> || {{PRONOM|fmt/464}} ||
|-
|Drawing 6.0 || <code>CDR6</code> || {{PRONOM|x-fmt/29}} ||
|-
|Drawing 7.0 || <code>CDR7</code> || {{PRONOM|x-fmt/291}} ||
|-
|Drawing 8.0 || <code>CDR8</code> || {{PRONOM|x-fmt/292}} ||
|-
|Drawing 8.0 Bidi || <code>cdr8</code> || ||
|-
|Drawing 9.0 || <code>CDR9</code> || {{PRONOM|x-fmt/374}} ||
|-
|Drawing 10.0 || <code>CDRA</code> || {{PRONOM|x-fmt/375}} ||
|-
|Drawing 11.0 || <code>CDRB</code> || {{PRONOM|x-fmt/378}} ||
|-
|Drawing 12.0 || <code>CDRC</code> || {{PRONOM|fmt/427}} ||
|-
|Drawing 12.5 || <code>DESC</code> || || || Only template
|-
|Drawing X3 || <code>CDRD</code> || {{PRONOM|fmt/428}} ||
|-
|Drawing X4 || <code>CDRE</code> || {{PRONOM|fmt/429}} ||
|-
|Drawing X5 || <code>CDRF</code> || {{PRONOM|fmt/430}} ||
|-
|Drawing X6 || rowspan="7"| .dat || <code>CDRG</code> || ||
|-
|Drawing X7 || <code>CDRH</code> || ||
|-
|Drawing X8 || <code>CDRJ</code> || ||
|-
|Drawing 2017 || <code>CDRK</code> || ||
|-
|Drawing 2018 || <code>CDRL</code> || ||
|-
|Drawing 2019 || <code>CDRM</code> || ||
|-
|Drawing 2020 || <code>CDRN</code> || ||
|-
|Template || .cdt .cdrt || || {{PRONOM|x-fmt/30}} || || Often same RIFF type as Drawing, but RIFF type CDST is used for version 4.4 and created by newer software start with RIFF type CDT and use cdrt extension
|-
|Compressed Drawing || .cdx || || {{PRONOM|x-fmt/31}} || CorelID=0x704
|-
|Presentation Exchange 5.0 ||rowspan="2"| .cmx ||rowspan="2"| <code>CMX1</code> || {{PRONOM|x-fmt/34}} || CorelID=0x702 ||rowspan="2"| See main article: [[CMX]]
|-
|Presentation Exchange 6+ || {{PRONOM|x-fmt/35}} || CorelID=0x701
|-
|CMX Compressed || .cpx || || {{PRONOM|x-fmt/36}} || CorelID=0x705
|-
|CCX Clipart || .ccx ||<code>CDRX</code> || || || See main article: [[CCX (Corel)]]
|-
|Pattern || .pat || || {{PRONOM|x-fmt/76}} || || Same as .cdr format?
|-
|Symbol Library || .csl ||<code>CSL?</code> || || || Same as .cdr format? Start with RIFF type CSL. Numeric version after vrsn tag does not match version digit at offset 11.
|}

== Format description ==

Early CorelDraw files are of an undocumented proprietary format where the first two bytes spell <code>WL</code> in [[ASCII]]. Later formats were based on [[RIFF]], with <code>RIFF</code> as the first four bytes and a version identifier in bytes 9 to 15. Til version 15 at offset 12 four character identifier vrsn occur, followed by the 32-bit integer 2 for chunk size and a 2 byte chunk content. The value of the content is calculated by sum of major version number multiplied by 100 and minor version number.
From version 16 at offset 12 four character identifier fver occur, followed by the 32-bit integer 16 for chunk size and a 16 bytes chunk content. The byte before the last byte of this chunk contains the major version number and the byte before contains the minor version number. The inner details (the data chunk of the RIFF version) remain proprietary.

Compressed formats, .CPX & .CDX are open/import only filters in versions of CorelDraw from version 6 on. Support for CDX was dropped after X6. Released as compressed formats on the Corel ArtShow CD's during the 1990's<ref>ftp://ftp.corel.com/pub/Other_Graphics_Apps/ArtShow/4550.txt</ref>.

* ArtShow 91 (File formats supported: CDR, PCX, DIB, MID)
* [https://archive.org/details/corel-art-show-3-1992 ArtShow 3] (File formats supported: BMP, CDR, PCX, PCD)
* [https://archive.org/details/corel-art-show-4-1993 ArtShow 4] (File formats supported: BMP, CD_, PCX, PCD) .CD_ files use [[MS-DOS_installation_compression|SDZZ]] compression.
* [https://archive.org/details/corel-art-show-5-1994 ArtShow 5] (File formats supported: CDX) Header begins with "{{magic|CDRCOMP1}}"
* [https://archive.org/details/corel-art-show-6-1995 ArtShow 6] & 7 (File formats supported: CPX) Header begins with "{{magic|CDRCOMP2}}"

== See also ==
* [[CCX (Corel)]]
* [[CMX]]
* [[SHW (Corel)]]
* [[WFN (font format)]]

== Software ==
* [https://wiki.documentfoundation.org/DLP/Libraries/libcdr libcdr]
* [https://www.libreoffice.org/ LibreOffice]
* [https://github.com/unoconv/unoconv unoconv]

== Sample files ==
* {{CdTextfilesURL|monstmedia/CLIPART/}} → *.CDR
* {{CdTextfilesURL|1stcanadian/graphics/cor2help/}}
* {{CdTextfilesURL|somuch/smsharew/CLIPART/1992CALS.ZIP}}
* {{CdTextfilesURL|ccbwindows93/CORELDRA/}}
* https://telparia.com/fileFormatSamples/document/ll_cover.cdr

== Links ==
* [[Wikipedia: CorelDRAW]]
* [https://www.corel.com/content/pdf/corporate/History_of_Corel.pdf History of Corel]
* [https://sk1project.net/modules.php?name=Products&product=sk1 sK1 program attempts to reverse-engineer CorelDRAW format]
* [http://libregraphicsworld.org/blog/entry/corel-draw-x6-file-format-subdued-by-libcdr Corel DRAW X6 file format subdued by libcdr]

== References ==
<references/>

[[Category:RIFF based file formats]]
[[Category:Corel]]

Corel Designer

2020-06-11T21:57:41Z

J2j: removed doubled corel.

{{FormatInfo
|formattype=electronic
|subcat=Graphics
|extensions={{ext|des}}
|mimetypes={{mimetype|application/x-vnd.corel.designer.document+zip}}, {{mimetype|application/x-vnd.corel.zcf.designer.document+zip}}
|released=2003
}}
'''Corel Designer''' is a engineering and graphic design application which belongs to the Corel Draw Technical Suite. Originally [[Micrografx Draw]], Corel purchased in 2001.

==File Identification==

Corel Designer 9 was Micrografx last release, Designer 10-12 was based on the [[RIFF]] format, while X4-onward is based on [[ZIP]]/[[XML]] format with X4-X6 wrapped around a <code>[[CorelDRAW|.CDR]]</code>. This begins with the characteristic local ZIP file header signature <code>PK</code>. The first archive member is an uncompressed file named <code>mimetype</code>. This 8-byte string is therefore also found at offset 30. The content of this file specifies the mime type of the corresponding Corel Designer graphic. From version 17 this type is <code>application/x-vnd.corel.zcf.designer.document+zip</code>. For older ZIP based versions this type is <code>application/x-vnd.corel.designer.document+zip</code>. Therefore we find this 49 or 45 byte long string at offset 38 in the ZIP archive. Starting with version 17, the RIFF based part is stored in a file named <code>root.dat</code>. For older ZIP based versions the corresponding file is called <code>riffData.cdr</code>. These files are stored in a folder called <code>content</code> in the archive. [[PRONOM]] binary signatures needed.

{| class="wikitable"
! Format / Version !! Ext. !! RIFF type !! PRONOM !! Year
|-
|Designer 9.0 || .dsf || n/a || {{PRONOM|x-fmt/151}} || 2002
|-
|Designer 10.0 || .des || <code>DESA</code> || || 2003
|-
|Designer 10.5 || .des || <code>DESB</code> || ||
|-
|Designer 12.0 || .des || <code>DESC</code> || || 2006
|-
|Designer X4 || .des || <code>DESE</code> || || 2008
|-
|Designer X5 || .des || <code>DESF</code> || || 2010
|-
|Designer 16 || .des || <code>DESG</code> || || 2013
|-
|Designer 17 || .des || <code>DESH</code> || || 2014
|-
|Designer 19 || .des || <code>DESI</code> || || 2017
|-
|Designer 20 || .des || <code>DESJ</code> || || 2018
|-
|Designer 21 || .des || <code>DESK</code> || || 2019
|}

==Links==
* [[Wikipedia: Corel_Designer]]
* [https://www.coreldraw.com/en/pages/old-brands/micrografx/ Looking for Micrografx?]

[[Category:Corel]]
[[Category:RIFF based file formats]]
[[Category:XML based file formats]]
[[Category:ZIP based file formats]]