#
# File signatures for known file types
#
# SYNTAX
# ======
# [File type description]
# StartsWith=<pattern>
# Containts=<pattern>
# Bytes=<number of bytes to scan from the start of the data>
# IgnoreCase=True (default = False)
# Extension=<extension name>
#
# <pattern> = 'text' or #<hexadecimal character code> or combination. For example 'PK'#AF is equivalent to #50#43#AF.
# <extension name> will be used to create a temporary file and to find the associated application to launch.
# StartsWith and Containts can be repeated multiple times in order to scan for multiple patterns.
#
[Microsoft Word 2007-2016 file]
StartsWith='PK'
Contains='word/_rels'
Bytes=10000
Extension=docx

[Microsoft Excel 2007-2016 file]
StartsWith='PK'
Contains='xl/_rels'
Bytes=10000
Extension='.xlsx'

[Microsoft Powerpoint 2007-2016 file]
StartsWith='PK'
Contains='rels/.rels'
Contains='slides'
Bytes=10000
Extension='.pptx'

[Microsoft Word 97-2003 file]
StartsWith=#D0#CF#11#E0#A1#B1#1A#E1
Contains=#EC#A5#C1
Bytes=1000
Extension='.doc'

[Microsoft Excel 97-2003 file]
StartsWith=#D0#CF#11#E0#A1#B1#1A#E1
Bytes=1000
Extension='.xls'

[Icon file]
StartsWith=#00#00#01#00
Extension='.ico'

[Graphics Interchange Format file]
StartsWith='GIF87a'
StartsWith='GIF89a'
Extension='.gif'

[Tagged Image File Format file]
StartsWith='II*'#00
StartsWith='MM'#00'*'
Extension='.tif'

[JPEG file]
StartsWith=#FF#D8#FF#DB
StartsWith=#FF#D8#FF#E0
StartsWith=#FF#D8#FF#E1
Extension='.jpg'

[Audio Interchange file]
StartsWith=#46#4F#52#4D
Extension='.aif'

[lzip compressed file]
StartsWith=#4C#5A#49#50
Extension='.lz'

[zip file ]
StartsWith=#50#4B#03#04
StartsWith=#50#4B#05#06
StartsWith=#50#4B#07#08
Extension='.zip'

[RAR archive]
StartsWith='Rar!'
Extension='.rar'

[Portable Network Graphics file]
StartsWith=#89#50#4E#47
Extension='.png'

[PostScript document]
StartsWith='%!PS'
Extension='.ps'

[PDF document]
StartsWith='%PDF'
Extension='.pdf'

[Advanced Systems Format file]
StartsWith=#30#26#B2#75#8E#66#CF#11#A6#D9#00#AA#00#62#CE#6C
Extension='.asf'

[Ogg file]
StartsWith='OggS'
Extension='.ogg'

[Photoshop Document file]
StartsWith='8BPS'
Extension='.psd'

[Waveform Audio file]
StartsWith='RIFF'
Contains='WAVE'
Bytes=20
Extension='.wav'

[Audio Video Interleave video file]
StartsWith='RIFF'
Contains='AVI'
Bytes=20
Extension='.avi'

[MP3 file]
StartsWith=#FF#FB
StartsWith='ID3'
Extension='.mp3'

[BMP file]
StartsWith='BM'
Extension='.bmp'

[Free Lossless Audio Codec file]
StartsWith='fLaC'
Extension='.flac'

[MIDI sound file]
StartsWith='MThd'
Extension='.mid'

[tar archive]
StartsWith='ustar'
Extension='.tar'

[7-Zip file]
StartsWith=#37#7A#BC#AF#27#1C
Extension='.7z'

[GZIP file]
StartsWith=#1F#8B
Extension='.gz'

[LZ4 Streaming Format file]
StartsWith=#04#22#4D#18
Extension='.lz4'

[Microsoft Cabinet file]
StartsWith='MSCF'
Extension='.cab'

[Free Lossless Image Format file]
StartsWith='FLIF'
Extension='.flif'

[Matroska media container file]
StartsWith=#1A#45#DF#A3
Extension='.mkv'

[QuickTime file]
Contains='ftypqt'
Bytes=100
Extension='.mov'

[XML File]
IgnoreCase=True
StartsWith='<?xml'
Extension='.xml'

[HTML file]
IgnoreCase=True
Contains='</HTML>'
Contains=.<!DOCTYPE HTML>'
Contains='</BODY>'
Extension='.html'
