?
Solved

Finding the file format

Posted on 2006-04-15
11
Medium Priority
?
610 Views
Last Modified: 2013-12-28
Experts,

I have a file which dosen't have any extension [someone removed the extension of the file from my system] I need to find out what kind of file is that. Is there any software avaliable to do that?

Please help me.

Thanks
Joe
0
Comment
Question by:venishjoe
  • 4
  • 3
  • 3
  • +1
11 Comments
 
LVL 30

Expert Comment

by:Irwin Santos
ID: 16461539
the best is to guess..

What kind of file do you THINK it is?

Graphic?
.jpg, .jpeg, .gif

Adobe Acrobat?
.pdf

Microsoft product?
.doc, .xls


How about making it an .txt and then open it up in Notepad.... read some of the info, and report back what it is.. better yet post some content of what you can read.
0
 
LVL 4

Author Comment

by:venishjoe
ID: 16461574
The file is big, around 250MB so I thought it would be a media file and tried opening the file in most media players and it never worked. I also tried with the common file formats which we normally use and it came under nothing. Also when I try to open the file in editor, the editor crashes.

So I thought there should be some software around there by which I can find the file type.

Thanks
Joe
0
 
LVL 4

Author Comment

by:venishjoe
ID: 16461593
I opened the file in MS Word and I got the following readable text

 $Info: This file is packed with the UPX executable packer http://upx.tsx.org $
 $Id: UPX 1.01 Copyright (C) 1996-2000 the UPX Team. All Rights Reserved. $
 UPX!


Thanks
Joe
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 30

Expert Comment

by:Irwin Santos
ID: 16461609
http://upx.sourceforge.net/

It's a compressed file that you need to upack with the above utility UPX.... did you download something large recently?
0
 
LVL 4

Author Comment

by:venishjoe
ID: 16461620
Yes, this was a downladed file and supposed to be a software. I downloaded UPX from http://upx.sourceforge.net/ and tried to decompress the file but I am getting a messgae stating This file is not compressed with UPX.

Thanks
Joe
0
 
LVL 30

Assisted Solution

by:Irwin Santos
Irwin Santos earned 150 total points
ID: 16461628
what's the name of the file?
0
 

Assisted Solution

by:zaphod_beeblebrox
zaphod_beeblebrox earned 75 total points
ID: 16462993
Maybe UPX can't unpack it because it wants to see a UPX extension. Try adding that and see if it works
0
 
LVL 39

Accepted Solution

by:
BillDL earned 150 total points
ID: 16464048
You definitely are seeing a FILE rather than a SHORTCUT here?
Windows will ALWAYS hide the extensions of files with the following extensions:
LNK - windows shortcut
PIF - DOS Shortcut
SCF - Windows Explorer Command
URL - Internet Link
SHB - Shortcut into a document
SHS - Scrap Object
And possibly will hide extensions of file types like Visual Basic Script, Windows Script, etc.

You are definitely also seeing the extensions of ALL file types?
Start Menu > Settings > Folder Options > View tab > show ALL files, and untick "hide extensions of know file types".

RIGHT-Click on the unknown file and choose "Properties".  Go to the "Version" tab if there is one, and see what it says under File Version, Description, and the set fields like "Original File Name".  Most 32-bit (Windows) .exe and .dll files will have a 2version" tab that can yield some details of the file so you can get some idea about what it was intended for and what the original name was.

UPX is used to compress executable files, dll's, etc, etc to make them smaller while retaining full functionality with the original file extension.  A file compressed this way is also harder to modify or steal the code. UPX isn't like WinZip, WinRAR, PKZIP, etc in that it creates a container into which it compresses one or more files, and renames the container as a zip, or other zipped file type.  UPX is primarily intended for compressing single files to make them more easily distributable in their program package, or to allow them all to be fitted onto portable media where they otherwise may not all fit.  When UPX is used on a file, it retains the original file name, unless of course a developer subsequently decided to rename it after packing it.

UPX Version 1.25 comes as a 32-bit Windows "console" version:
http://upx.sourceforge.net/download/upx125w.zip

or as a 32-bit DOS version:
http://upx.sourceforge.net/download/upx125d.zip

Both are capable of packing and unpacking the following file types:

Windows 32-bit *.exe or *.dll
DOS *.com, *.exe, and *.sys
And a load of other file types generated from applications for other operating systems like Linux.

So, as long as you know for certain that the file was intended for use in Windows or DOS, rather than for some other OS, then you could try renaming it to any of the above extensions.  If it is a Windows (32-bit) *.EXE file, then it is highly likely to have its own icon.  If you rename the file to an .exe file, and see the icon change to a distinctly different one, then you most likely have found the original extension.

What was this file SUPPOSED to be for?
Unless you know what you are doing, you can mess up your system trying to open or run unknown files or introducing them to your system.

Dowload the following program file:
http://members.ping.at/mlubich/peek11.zip

Unzip it with Winzip or other program until you have PEEK.DLL, PEEK.INF, and Readme.txt in the same folder.
Right-Click on peek.INF and choose "Install".  Follow the prompts.
This copies Peek.dll and Peek.inf to C:\Windows\System\ShellExt and creates registry entries that give you a new Right-Click menu option for all file types.

Right-Click on your unknown file and choose "Peek".  You can choose Standard, Binary, or Unicode.  Start off with the "Standard" option.  It extracts as much textual content as it can to a file C:\Windows\TEMP\Peek.txt without affecting or modifying the original file.  Peek can always be uninstalled later from your Add/Remove Programs list, but I doubt you will get rid of it.

A file packed with UPX will have the following lines added near the top in the file's header information.
UPX0
UPX1
If you see that, then you know it has been packed with UPX and can test if it is capable of being unpacked using UPX:

upx -t filename.exe

Even if a filename has been renamed without the proper extension, it can still be tested for integrity.
If the file is uncorrupted, and the contents required to unpack it are sound, then it will report:

testing filename.exe [OK]
Tested 1 file.

To unpack a file, use the command    upx -d filename.exe.
Here's an example of unpacking CALC.EXE (Windows Calculator) which I first packed with UPX and renamed to "TEST" ie. without the file extension:

File size                 Ratio      Format      Name
--------------------   ------      -----------   -----------
94208 <-   30720   32.61%   win32/pe   test
Unpacked 1 file.

That "win32/pe" tells you that it is a 32-bit Windows executable (.exe or .dll).

You will see this if you "list" the details about a file that has been packd with UPX:
upx -l filename.exe

File size                Ratio      Format      Name
--------------------   ------     -----------   -----------
94208 ->  30720   32.61%   win32/pe   test

Even when packed with UPX and renamed to another file name without the proper extension, this file's Right-Click "properties" still tell me that it is:

Description: Windows Calculator application file
Version: 5.00.1764.1
Original File name: CALC.EXE.

If using PEEK to examine files, you usually find some giveaway signs of the file's type by the general layout.
If you can paste SOME of the contents here as extracted by peek, then we might be able to determine the file type.

Bill
0
 
LVL 39

Expert Comment

by:BillDL
ID: 16464054
In fact, provide us with the link from where you downloaded the file as part of a package and we can have a look.
Are you sure you didn't download a version intended for Linux or some other Operating System?
0
 
LVL 4

Author Comment

by:venishjoe
ID: 16464898
I tried downloading the 32bit windows version and I am able to uncompress the file.

Thanks for all your help.

Thanks
Joe
0
 
LVL 39

Expert Comment

by:BillDL
ID: 16467219
Thank you Joe.  Hopefully you can figure out what the file type should have been.

One warning though.  If this file exists on your computer as a result of installing a software package, then the installer routine has probably created a log that could be used if you uninstall the software.  Sometimes the file sizes are important to the uninstallation routine, and inflating the previously UPX-packaged file will now make it larger.  This could confuse the uninstaller even if you do manage to rename the file with the correct extension.

In addition to that, the actual software may do an integrity checkup on its own files when it is run, and may detect that the file size has changed.  It may see this as tampering, and cease to work or demand that you reinstall the program.

If you have a backup program that uses file sizes in any pre-configured jobs to create and restore backups, then that could also be a problem - especially during any restore process.

Undoubtedly this file was intended to remain compressed by the software authors when they wrote the package and installer.  I'm not sure why you really needed to unpack the file to find out what file file extension it should have had.  As I mentioned earlier, UPX packing is used on files just to reduce their size, but the file names remain unchanged.

Admittedly you MAY be able to see more of the content of the file through a utility like PEEK now that you have unpacked the file, but if you then intend to rename the file with the proper extension and repack it, then you have no idea what compression ratio's and other options were used when the file was originally compressed with UPX.  The UPX program (in either the 32-bit Windows or DOS versions) can accept quite a few command line options that you should know about.

The upx.html file that comes as part of the downloaded package will explain what the rather complicated options like this mean and do:
upx --best --crp-ms=999999 --nrv2b -o filename.exe

Also read the section on Win32/PE where it discusses how Screensaver file types (*.scr) are handled uniquely.

Bill
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is about my experience upgrading my consulting machine to Windows 10 Version 1709 (The Fall 2017 Creator Update)
MS Outlook undoubtedly is the most widely used email client.Its user-friendliness, cost effectiveness, and availability with Microsoft Office Suite make it the most popular email application.  Its compatibility with Microsoft applications like Exch…
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question