Take the 2-minute tour ×

This question already has an answer here:

Say you are given a file whose extension has been removed or changed (file.tar.gz --> file.blah). This file is decompressed and its contents are used by an application. But you don't have access to that application to know how. So how do you figure the file's extension to be able to decompress it for yourself? For example can you do that by inspecting the file with a hex editor?

share|improve this question

migrated from security.stackexchange.com Mar 10 '13 at 12:52

This question came from our site for Information security professionals.

marked as duplicate by Arjan, TFM, Daniel Andersson, Nifle, Everett Mar 10 '13 at 19:55


Many files begin with magic numbers like 0xCAFEBABE in Java .class files, <?xml in XML, etc. Also, check this out: en.wikipedia.org/wiki/List_of_file_signatures –  Henning Klevjer Mar 10 '13 at 12:36
Also, this might smell better on Superuser. –  Henning Klevjer Mar 10 '13 at 12:43
Is the compression aspect of the question valuable? Or could the question be more clearly stated as "How to find the extension of a file once it has been removed or changed?" –  BrianAdkins Mar 10 '13 at 12:53
Use the file command? –  billc.cn Mar 10 '13 at 13:19
add comment

2 Answers

Use the file command on the file?

share|improve this answer
add comment

You can identify most common file types by looking at their file headers in an hex editor (first block of bytes of the file), i.e. .exe files used by msdos systems use MZ at offset 0h, or a zip file has the following header, etc.

I would do a search with, say, the first 8 bytes of the file.

share|improve this answer
add comment
