1186690Sobrien 2186690Sobrien#------------------------------------------------------------------------------ 3234449Sobrien# $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $ 4186690Sobrien# windows: file(1) magic for Microsoft Windows 5186690Sobrien# 6186690Sobrien# This file is mainly reserved for files where programs 7186690Sobrien# using them are run almost always on MS Windows 3.x or 8186690Sobrien# above, or files only used exclusively in Windows OS, 9186690Sobrien# where there is no better category to allocate for. 10186690Sobrien# For example, even though WinZIP almost run on Windows 11186690Sobrien# only, it is better to treat them as "archive" instead. 12186690Sobrien# For format usable in DOS, such as generic executable 13186690Sobrien# format, please specify under "msdos" file. 14186690Sobrien# 15186690Sobrien 16186690Sobrien 17186690Sobrien# Summary: Outlook Express DBX file 18186690Sobrien# Extension: .dbx 19186690Sobrien# Created by: Christophe Monniez 20186690Sobrien0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 21186690Sobrien>4 byte =0xC5 \b, message database 22186690Sobrien>4 byte =0xC6 \b, folder database 23186690Sobrien>4 byte =0xC7 \b, account information 24186690Sobrien>4 byte =0x30 \b, offline database 25186690Sobrien 26186690Sobrien 27186690Sobrien# Summary: Windows crash dump 28186690Sobrien# Extension: .dmp 29186690Sobrien# Created by: Andreas Schuster (http://computer.forensikblog.de/) 30186690Sobrien# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 31186690Sobrien# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 32186690Sobrien0 string PAGE 33186690Sobrien>4 string DUMP MS Windows 32bit crash dump 34186690Sobrien>>0x05c byte 0 \b, no PAE 35186690Sobrien>>0x05c byte 1 \b, PAE 36186690Sobrien>>0xf88 lelong 1 \b, full dump 37186690Sobrien>>0xf88 lelong 2 \b, kernel dump 38186690Sobrien>>0xf88 lelong 3 \b, small dump 39186690Sobrien>>0x068 lelong x \b, %ld pages 40186690Sobrien>4 string DU64 MS Windows 64bit crash dump 41186690Sobrien>>0xf98 lelong 1 \b, full dump 42186690Sobrien>>0xf98 lelong 2 \b, kernel dump 43186690Sobrien>>0xf98 lelong 3 \b, small dump 44186690Sobrien>>0x090 lequad x \b, %lld pages 45186690Sobrien 46186690Sobrien 47186690Sobrien# Summary: Vista Event Log 48186690Sobrien# Extension: .evtx 49186690Sobrien# Created by: Andreas Schuster (http://computer.forensikblog.de/) 50186690Sobrien# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 51186690Sobrien0 string ElfFile\0 MS Windows Vista Event Log 52186690Sobrien>0x2a leshort x \b, %d chunks 53186690Sobrien>>0x10 lelong x \b (no. %d in use) 54186690Sobrien>0x18 lelong >1 \b, next record no. %d 55186690Sobrien>0x18 lelong =1 \b, empty 56186690Sobrien>0x78 lelong &1 \b, DIRTY 57186690Sobrien>0x78 lelong &2 \b, FULL 58186690Sobrien 59186690Sobrien 60186690Sobrien# Summary: Windows 3.1 group files 61186690Sobrien# Extension: .grp 62186690Sobrien# Created by: unknown 63186690Sobrien0 string \120\115\103\103 MS Windows 3.1 group files 64186690Sobrien 65186690Sobrien 66186690Sobrien# Summary: Old format help files 67186690Sobrien# Extension: .hlp 68186690Sobrien# Created by: Dirk Jagdmann <doj@cubic.org> 69186690Sobrien0 lelong 0x00035f3f MS Windows 3.x help file 70186690Sobrien 71186690Sobrien 72186690Sobrien# Summary: Hyper terminal 73186690Sobrien# Extension: .ht 74186690Sobrien# Created by: unknown 75186690Sobrien0 string HyperTerminal\ 76186690Sobrien>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 77186690Sobrien 78186690Sobrien 79186690Sobrien# Summary: Windows shortcut 80186690Sobrien# Extension: .lnk 81186690Sobrien# Created by: unknown 82186690Sobrien0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 83186690Sobrien 84186690Sobrien 85186690Sobrien# Summary: Outlook Personal Folders 86186690Sobrien# Created by: unknown 87186690Sobrien0 lelong 0x4E444221 Microsoft Outlook email folder 88186690Sobrien>10 leshort 0x0e (<=2002) 89186690Sobrien>10 leshort 0x17 (>=2003) 90186690Sobrien 91186690Sobrien 92186690Sobrien# Summary: Windows help cache 93186690Sobrien# Created by: unknown 94186690Sobrien0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 95186690Sobrien 96186690Sobrien 97186690Sobrien# Summary: IE cache file 98186690Sobrien# Created by: Christophe Monniez 99186690Sobrien0 string Client\ UrlCache\ MMF Internet Explorer cache file 100186690Sobrien>20 string >\0 version %s 101186690Sobrien 102186690Sobrien 103186690Sobrien# Summary: Registry files 104186690Sobrien# Created by: unknown 105186690Sobrien# Modified by (1): Joerg Jenderek 106186690Sobrien0 string regf MS Windows registry file, NT/2000 or above 107186690Sobrien0 string CREG MS Windows 95/98/ME registry file 108186690Sobrien0 string SHCC3 MS Windows 3.1 registry file 109186690Sobrien 110186690Sobrien 111186690Sobrien# Summary: Windows Registry text 112186690Sobrien# Extension: .reg 113186690Sobrien# Submitted by: Abel Cheung <abelcheung@gmail.com> 114186690Sobrien0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 115186690Sobrien0 string Windows\ Registry\ Editor\ 116186690Sobrien>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 117192350Sdelphij 118192350Sdelphij 119192350Sdelphij# From: Pal Tamas <folti@balabit.hu> 120192350Sdelphij# Autorun File 121192350Sdelphij0 string/c [autorun]\r\n Microsoft Windows Autorun file. 122192350Sdelphij!:mime application/x-setupscript. 123