We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now

x

.doc, .xls, .ppt Magic Bytes?

essentialtalk
on
Medium Priority
1,404 Views
Last Modified: 2008-01-09
Does anyone know the true "magic bytes" for .doc, .xls and .ppt.

I have come across the following:

.ppt: d0cf11e0a1b11ae100000000
.xls:  d0cf11e0a1b11ae100
.doc: d0cf11e0a1b11ae1

The problem with those magic bytes is that both xls and ppt's have the extra zeros on the end too.

I have also seen:

fdff at offset 512

this is also common to all office documents.


How can I tell the difference between .doc, .xls and .ppt?

And soon coming with office 2k7 .docx, .xlsx, .pptx?

Thanks

Matt
Comment
Watch Question

Commented:
1) Could you use the extension?

2) http://www.wotsit.org/default.asp 
Might be a good resource for you.

3) http://www.google.com/codesearch?hl=en&lr=&q=d0cf11e0&btnG=Search

This is a google code search for the OLE signature.  You might be able to find some more magic bytes (or references) by looking at existing code.

Good luck

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.