.doc, .xls, .ppt Magic Bytes?

Does anyone know the true "magic bytes" for .doc, .xls and .ppt.

I have come across the following:

.ppt: d0cf11e0a1b11ae100000000
.xls:  d0cf11e0a1b11ae100
.doc: d0cf11e0a1b11ae1

The problem with those magic bytes is that both xls and ppt's have the extra zeros on the end too.

I have also seen:

fdff at offset 512

this is also common to all office documents.


How can I tell the difference between .doc, .xls and .ppt?

And soon coming with office 2k7 .docx, .xlsx, .pptx?

Thanks

Matt
essentialtalkAsked:
Who is Participating?
 
SCDMETACommented:
1) Could you use the extension?

2) http://www.wotsit.org/default.asp 
Might be a good resource for you.

3) http://www.google.com/codesearch?hl=en&lr=&q=d0cf11e0&btnG=Search

This is a google code search for the OLE signature.  You might be able to find some more magic bytes (or references) by looking at existing code.

Good luck
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.