1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
|
#------------------------------------------------------------------------------
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
0 string GDBM GNU dbm 2.x database
#
# Berkeley DB
#
# Ian Darwin's file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.
0 long 0x00061561 Berkeley DB
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, little-endian)
0 belong 0x00061561 Berkeley DB
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, big-endian)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
0 long 0x00053162 Berkeley DB 1.85/1.86
>4 long >0 (Btree, version %d, native byte-order)
0 belong 0x00053162 Berkeley DB 1.85/1.86
>4 belong >0 (Btree, version %d, big-endian)
0 lelong 0x00053162 Berkeley DB 1.85/1.86
>4 lelong >0 (Btree, version %d, little-endian)
12 long 0x00061561 Berkeley DB
>16 long >0 (Hash, version %d, native byte-order)
12 belong 0x00061561 Berkeley DB
>16 belong >0 (Hash, version %d, big-endian)
12 lelong 0x00061561 Berkeley DB
>16 lelong >0 (Hash, version %d, little-endian)
12 long 0x00053162 Berkeley DB
>16 long >0 (Btree, version %d, native byte-order)
12 belong 0x00053162 Berkeley DB
>16 belong >0 (Btree, version %d, big-endian)
12 lelong 0x00053162 Berkeley DB
>16 lelong >0 (Btree, version %d, little-endian)
12 long 0x00042253 Berkeley DB
>16 long >0 (Queue, version %d, native byte-order)
12 belong 0x00042253 Berkeley DB
>16 belong >0 (Queue, version %d, big-endian)
12 lelong 0x00042253 Berkeley DB
>16 lelong >0 (Queue, version %d, little-endian)
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
0 string RRD RRDTool DB
>4 string x version %s
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0 string root\0 ROOT file
>4 belong x Version %d
>33 belong x (Compression: %d)
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
#2 leshort 0x0800 Paradox
#>0x39 byte 3 v. 3.0
#>0x39 byte 4 v. 3.5
#>0x39 byte 9 v. 4.x
#>0x39 byte 10 v. 5.x
#>0x39 byte 11 v. 5.x
#>0x39 byte 12 v. 7.x
#>>0x04 byte 0 indexed .DB data file
#>>0x04 byte 1 primary index .PX file
#>>0x04 byte 2 non-indexed .DB data file
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
#>>0x04 byte 4 secondary index .Ynn file
#>>0x04 byte 5 incrementing secondary index .Xnn file
#>>0x04 byte 6 non-incrementing secondary index .XGn file
#>>0x04 byte 7 secondary index .YGn file
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
#0 byte 0x02
#>8 leshort >0
#>>12 leshort 0 FoxBase
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x03
#>8 leshort >0
#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x04
#>8 leshort >0
#>>12 leshort 0 dBASE IV no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x05
#>8 leshort >0
#>>12 leshort 0 dBASE V no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x30
#>8 leshort >0
#>>12 leshort 0 Visual FoxPro
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x43
#>8 leshort >0
#>>12 leshort 0 FlagShip with memo var size
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x7b
#>8 leshort >0
#>>12 leshort 0 dBASEIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x83
#>8 leshort >0
#>>12 leshort 0 FoxBase+, dBaseIII+ with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8b
#>8 leshort >0
#>>12 leshort 0 dBaseIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8e
#>8 leshort >0
#>>12 leshort 0 dBaseIV with SQL Table
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xb3
#>8 leshort >0
#>>12 leshort 0 FlagShip with .dbt memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xf5
#>8 leshort >0
#>>12 leshort 0 FoxPro with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 leshort 0x0006 DBase 3 index file
# MS Access database
4 string Standard\ Jet\ DB Microsoft Access Database
# TDB database from Samba et al - Martin Pool <mbp@samba.org>
0 string TDB\ file TDB database
>32 lelong 0x2601196D version 6, little-endian
>>36 lelong x hash size %d bytes
# SE Linux policy database
0 lelong 0xf97cff8c SE Linux policy
>16 lelong x v%d
>20 lelong 1 MLS
>24 lelong x %d symbols
>28 lelong x %d ocons
# ICE authority file data (Wolfram Kleff)
2 string ICE ICE authority data
# X11 Xauthority file (Wolfram Kleff)
10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
# SQLite (Ty Sarna)
0 string **\ This\ file\ contains\ an\ SQLite SQLite Database
>&1 regex [^\ ]+ Version %s
|
