[File] [PATCH] of Magdir/ole2compounddocs,msdos,wordprocessors for CDF; updates + extension
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Sun Jul 28 17:02:18 UTC 2019
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello,
some days ago i get a Microsoft Publisher document (*.pub). When i run
file command version 5.37 on such files it was recognized as a
OLE 2 Compound Document but sub type identification is missing or
duplicate identification happened. Then i also look for other Compound
Document files (abbreviated as cdf) on my system, especially other
popular office application like StarOffice and other Microsoft
programs. After getting a test collection, i get undetermined sub
type for examples when i run file with options -k -e cdf like stored
in appended file-5.37-soft.txt
The identification happens in Magdir/ole2compounddocs by line like
0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
Unfortunately this pattern is not unique enough. So some additional
test lines are needed. Furthermore only ??? is displayed when
executing file command with --extension option.
Even when i use the internal cdf recognition parts of file command,
some examples are not precisely recognized. And i got an output with
- -e soft option like in appended file-5.37-cdf.txt.
First i look how samples are identified by other tools. I use TrID.
TrID is an utility designed to identify file types from their binary
signatures ( see http://mark0.net/soft-trid-e.html ).
In the end to catch many different existing types i use the following
procedure:
Download pattern database "triddefs_xml.7z" of TrID. Extract 7z
archive. Look in extracted trid definition files *.trid.xml for patter
n
<Bytes>D0CF11E0A1B11AE100</Bytes>
DROID (Digital Record and Object Identification) is a software tool
developed by The National Archives to perform automated batch
identification of file formats. See
https://digital-preservation.github.io/droid/
So i add lines to Magdir/ole2compounddoc. Some Information about that
file format is found on OpenOffice website. So i add comment line like
# reference: https://www.openoffice.org/sc/compdocfileformat.pdf
According to that document the major version number is now shown by
line like
>>>0x1A uleshort x \b, v%u
For real examples this number is 3 or 4. So skip bad droid skeletons
like fmt-39-signature-id-128.doc by additional test for valid version
>0x1A ushort !0xABAB
The byte order is stored inside ole2 files. Big-endian could occur,
but in real world inspected samples only little-endian was used. So
test for little-endian and then continue by additional line
>>0x1C uleshort =0xfffe
Now for little endian examples show some useful information.
Display number of first sector of the directory stream by line
>>>48 ulelong x \b, SecID 0x%x
The exponent of sector size with basis 2 is stored inside header.
Minimum value is 7. In most cases value is 9 for sector size 512 and
some times value Ch=12 for 4096 is found. For every block size create
a branch with magic lines. For block size value 512 this start with
line like:
>>>0x1E uleshort 9 \b, blocksize 512
Afterwards jump to one block (512 bytes per block here) before root
storage block by line like
>>>>(48.l*512) ubyte x
Unfortunately this pointer construct does not work for samples like
Red-Carpet-presentation-1.0-1.sdd sg10.sdv XnView_metadata.doc
"Barham, Lisa - Die Shopping-Prinzessinnen.doc" or
2000_GA_Annual_Review_Data.xls with standard configuration. And the
file command display no error message. So i display such message after
SecID information by additional line
>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
If you want that such samples are recognized, the FILE_BYTES_MAX value
must be raised. For doc file with SecID 0x3144 a size of 6,158203125
MiB is needed. So raise limit up to 7 MiB by changed line in
src/file.h like
# define FILE_BYTES_MAX (7168 * 1024)
Afterwards jump 1 block forward to directory stream, inspect this
structure by subroutine and display sub type according to stored GUID
>>>>>&511 use ole2-directory
0 name ole2-directory
To check that jump to directory stream was successful, i first check
for Root entry by looking for type 5 value by line
>66 ubyte 5
The first sub type classification in ole2compounddocs was done by line
> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
This matched only for some accident conditions like second directory
entry is UTF-16 string "VisioDocument" with SecID 0x1 and block size
512. So test files mentioned on fileformats.archiveteam.org with SecID
0x2 like Visio2002Test.vsd are not recognized because characteristic
string now appears at offset 0x680. But instead of looking for
directory entry name i test for 16 byte sized Unique identifier when
possible ( GUID clsid is not null).
The GUID can be shown for inspected samples by debug lines likes
>80 ubequad !0 \b, clsid 0x%16.16llx
>>88 ubequad x \b%16.16llx
Or you look for known GUID on web sides like
https://wikileaks.org/ciav7p1/cms/page_13762814.html
Often the GUID are listen as string format with curly braces. For file
command such string must be converted to hexadecimal representation by
converters like www.windowstricks.in/online-windows-guid-converter.
So i test for second part of GUID by line like
>>88 ubequad 0xc000000000000046 : Microsoft
So some Microsoft files are detected. Microsoft Visio samples are
described by other 8 bytes of GUID by line like
>>>80 ubequad 0x131a020000000000 Visio Document, stencil or template
Aftwerwards now show mime type by line
!:mime application/vnd.visio
The filename extension varies. For Drawing VSD is used. For stencil it
is VSS and for template it is VST. This is now expressed by line
!:ext vsd/vss/vst
An other advantage of testing by GUID is that GUID changes for
different file type versions. So the above id is used for Visio
versions 2000-2002. So Visio 2003-2010 versions are recognized by
additional test block starting with line like
>>>80 ubequad 0x141a020000000000 Visio 2003 Document
The first part of GUID is also used by Windows installer files. These
are described by additional test lines like
>>> 80 ubequad 0x84100c0000000000 Windows Installer Package
!:mime application/x-msi
!:ext msi
>>> 80 ubequad 0x86100c0000000000 Windows Installer Patch
!:mime application/x-wine-extension-msp
!:ext msp
Also used for Word document variant like example harmless-clean.doc by
lines like
>>>80 ubequad 0x0609020000000000 Word 97-2003 doc or template
!:mime application/msword
Doc is usual file name extension, but for template dot is used and on
Macintosh no file name extension is used. This is now expressed by lin
e
!:ext doc/dot/
For template apple id is MSWDW8TN, which is different for doc-files
expressed by line
!:apple MSWDWDBN
These lines replace the old unreliable test starting with line
>546 string bjbj : Microsoft Word Document
Also some Outlook files are matched. Often such files are described as
Outlook Message, but i found inside Windows registry description text
Outlook Item. Furthermore there does not exist an official mime type
application/vnd.ms-outlook. For template another GUID is used and file
name extension oft instead msg is used. So such outlook examples are
described by code segments
>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
!:mime application/x-ms-msg
!:ext msg
>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
!:mime application/x-ms-oft
!:ext oft
Then i add also remaining seen GUID of other file types in the same
way. So catch more non null clsid values i also add lines like
>>88 default x : UNKNOWN
!:mime application/x-ole-storage
>>>80 ubequad !0 \b, clsid 0x%16.16llx
>>>88 ubequad x \b%16.16llx
So possible undetected samples like test guidunknown.ole2 get correct
mime type.
Unfortunately not all cdf types have an unique GUID. So look for
samples with CLSID GUID value zero by sub branch starting with lines
like
>>88 ubequad 0x0
>>>80 ubequad 0x0
At that point often no exact file type documentation exist, but often
a characteristic directory entry name exist.
So Microstation V8 DGN samples like 1344468165.dgn seems to have a
second directory entry name "Dgn~H" or "Dgn~S". This is now expressed
by code segment like
>>>>128 lestring16 Dgn~ : Microstation V8 CAD
!:mime application/x-bentley-dgn
!:ext dgn
This replaces the old unreliable segment with line
> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
Hangul (Korean) 5.0 Word Processor files like 100723-.hwp and
example.hwp seems to have second directory entry name FileHeader with
significant signature "HWP Document File". This are now identified by
lines like
>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor
!:mime application/x-hwp
!:ext hwp
To detect possible more CDF examples like test guidNull.ole2 with null
clsid i add lines like
>>>>128 default x : UNKNOWN
!:mime application/x-ole-storage
After handling the samples with blocks size 512 do same procedure for
samples with exponent 12 (that is block size 4096) by additional
branch like
>>>0x1E uleshort 0xc \b, blocksize 4096
>>>>(48.l*4096) ubyte x
>>>>>&4095 use ole2-directory
Now also samples like AusweisApp2-1.16.1.msi are identified precisely.
For some samples i get duplicate descriptions. When example is already
recognized by Magdir/ole2compounddocs, then others by Magdir/msdos are
not needed. So remove for example like WORD60ES.DOC lines like
2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6
2112 string MSWordDoc Microsoft Word document data
So remove for example DOT60.DOT lines with
2080 string Microsoft\ Word\ 6.0\ Document %s
So remove for example test-italian.xls lines with
2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
So remove for example ANALYSIS.XLA lines with
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
So remove for example like SLIDES.XLT lines with
2114 string Biff5 Microsoft Excel 5.0 Worksheet
I found no example for next code segment, but apparently this is also
a cdf format. So i also remove lines with
2121 string Biff5 Microsoft Excel 5.0 Worksheet
At the beginning of directory entry structure the name is stored as
UTF-16 string which can be displayed by a debug line like:
>0 lestring16 x \b, 1st %.10s
For the root directory this is "Root Entry".
So remove for example surfnet-keynote.doc lines with
512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
This pattern applies not only to DOC files, but also to other CDF
files, with some suited SecID and block size combination.
The same error occurs in Magdir/wordprocessors. So remove there lines
starting with
512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
By that lines samples like outlook item 15.11.10_Schiwy.msg and
Corel PrintHouse image DINASAUR.CPH are also misidentified as Hangul
(Korean) Word Processor File 2000.
After applying the above mentioned modifications by patch
file-5.37-ole2compounddocs.diff, file-5.37-msdos-ole2compounddocs.diff
and file-5.37-wordprocessors-ole2compounddocs.diff then cdf files have
no duplicate descriptions and are described more precisely stored in
appended file-soft-new.txt
I hope my diff files can be applied in future version of file utility.
I have done my best to catch most popular cdf, but according to Trid
database there still exist more exotic cdf files. Furthermore often fo
r
mime type and apple id there is no precise declaration.
With best wishes
Jörg Jenderek
- --
Jörg Jenderek
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXT3VEAAKCRCv8rHJQhrU
1qDfAKCgQRfhqyyp28PEaMy9qShu5c46xgCfcKJjtF2VSsd7UD3kuqwvh4xpnhs=
=McaO
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.37/magic/Magdir/msdos.old 2019-04-19 00:42:27 +0000
+++ file-5.37/magic/Magdir/msdos 2019-07-26 21:56:30 +0000
@@ -649,9 +649,2 @@
# Popular applications
-2080 string Microsoft\ Word\ 6.0\ Document %s
-!:mime application/msword
-2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
-!:mime application/msword
-# Pawel Wiecek <coven at i17linuxb.ists.pwr.wroc.pl> (for polish Word)
-2112 string MSWordDoc Microsoft Word document data
-!:mime application/msword
#
@@ -688,5 +681,2 @@
#
-2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
-!:mime application/vnd.ms-excel
-#
0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
@@ -694,13 +684,8 @@
-2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
-!:mime application/vnd.ms-excel
#
-# Pawel Wiecek <coven at i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
-2114 string Biff5 Microsoft Excel 5.0 Worksheet
-!:mime application/vnd.ms-excel
-# Italian MS-Excel
-2121 string Biff5 Microsoft Excel 5.0 Worksheet
-!:mime application/vnd.ms-excel
0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php
+!:apple XCELXLS4
+!:ext xls
#
@@ -1399,5 +1384,2 @@
-512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
-!:mime application/msword
-
# From: "Nelson A. de Oliveira" <naoliv at gmail.com>
-------------- next part --------------
--- file-5.37/magic/Magdir/wordprocessors.old 2019-04-19 00:42:27 +0000
+++ file-5.37/magic/Magdir/wordprocessors 2019-07-27 20:53:56 +0000
@@ -198,5 +198,2 @@
0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
-# From: Won-Kyu Park <wkpark at kldp.org>
-512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
-!:mime application/x-hwp
-------------- next part --------------
100723-.hwp: Hangul (Korean) Word Processor File 5.x
1344468165.dgn: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.0, Code page: 1200, Locale ID: 1033, Create Time/Date: *Bad* 0x28f2c9c047d0cc93, Author: wens, Last Saved By: wens, Last Saved Time/Date: *Bad* 0x08583b0047d0cc94, Revision Number: 0, Name of Creating Application: MicroStation
15.11.10_Schiwy.msg: CDFV2 Microsoft Outlook Message
3-Spalten-Layout: Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Author: Microsoft Corp., Template: 3-Spalten-Layout, Last Saved By: Microsoft Corporation, Revision Number: 2, Name of Creating Application: Microsoft Word 8.0, Create Time/Date: Sun Mar 29 17:25:00 1998, Last Saved Time/Date: Sun Mar 29 17:26:00 1998, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
7z1806.msi: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: 7-Zip Package, Author: Igor Pavlov, Keywords: Installer, Comments: 7-Zip Package, Template: Intel;1033, Revision Number: {23170F69-40C1-2701-1806-000002000000}, Number of Pages: 200, Number of Words: 2, Security: 2, Create Time/Date: Sun Dec 30 14:19:23 2018, Last Saved Time/Date: Sun Dec 30 14:19:23 2018, Name of Creating Application: Windows Installer XML v2.0.3719.0 (candle/light)
9_by_6_fullcpy_preview.wps: Composite Document File V2 Document, Cannot read section info
ANALYSIS.XLA: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.10, Title: MS Excel 4.0 Analysis Tools, Author: Microsoft Corporation, Comments: Provides backward compatibility for Microsoft Excel 4.0 Analysis Tools., Name of Creating Application: Microsoft Excel, Security: 0
AusweisApp2-1.16.1.msi: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AusweisApp2, Author: Governikus GmbH & Co. KG, Keywords: Personalausweis, Authentisierung, Comments: Installationspaket für die AusweisApp2, Template: Intel;1031, Revision Number: {B7F6E787-6993-4226-8AEB-1550E3A609F1}, Create Time/Date: Fri Dec 21 11:40:24 2018, Last Saved Time/Date: Fri Dec 21 11:40:24 2018, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
b7ea.rra: Composite Document File V2 Document, Cannot read section info
BALOU_C.WPS: Composite Document File V2 Document, Cannot read section info
Barham, Lisa - Die Shopping-Prinzessinnen.doc: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: , Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Last Printed: Sat Jan 06 21:23:00 2007, Create Time/Date: Thu Aug 18 17:24:00 2011, Last Saved Time/Date: Thu Aug 18 17:56:00 2011, Number of Pages: 226, Number of Words: 45699, Number of Characters: 287905, Security: 0
DINASAUR.CPH: Composite Document File V2 Document, Cannot read section info
DOT60.DOT: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.95, Template: NORMAL.DOT, Title: title_60, Subject: subject_6.0, Keywords: keword_6.0, Comments: winword 6.0, Author: win98se, Last Saved By: win98se, Create Time/Date: Fri Mar 24 04:06:00 2017, Last Printed: Fri Dec 31 00:00:00 2027, Last Saved Time/Date: Fri Mar 24 04:06:00 2017, Number of Words: 1, Number of Characters: 11, Total Editing Time: 01:00, Name of Creating Application: Microsoft Word 6.0, Number of Pages: 1, Revision Number: 2, Security: 0
Elternabend1998.sdd: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Last Saved By: , Author: , Title: Elternabend1998
EXPTOOWS.XLA: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, Code page: 1252, Author: Microsoft Corporation, Last Saved By: Administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Mar 14 20:37:56 2000, Last Saved Time/Date: Tue May 06 04:17:55 2003, Security: 0
f01b4d95cf55d32a.automaticDestinations-ms: Composite Document File V2 Document, Cannot read section info
f278646.msp: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, Title: Patch;outlook;14.0.7171.5000, Subject: Patch, Author: Microsoft Corporation, Template: {91140000-0013-0000-1000-0000000FF1CE};{91140000-001A-0000-1000-0000000FF1CE};{90140000-001A-0000-1000-0000000FF1CE};{91140000-0033-0000-1000-0000000FF1CE};{91140000-0011-0000-1000-0000000FF1CE};{91140000-011D-0000-1000-0000000FF1CE};{90140000-0011-0000-1000-0000000FF1CE};{91140000-0014-0000-1000-0000000FF1CE};{90140000-003D-0000-1000-0000000FF1CE};{91140000-008B-0000-1000-0000000FF1CE};{90140000-008B-0000-1000-0000000FF1CE};{91140000-0012-0000-1000-0000000FF1CE};{90140000-0012-0000-1000-0000000FF1CE}, Last Saved By: :9100130000100014.0.7015.1000;:#9100130000100014.0.7015.1000;:91001A0000100014.0.7015.1000;:#91001A0000100014.0.7015.1000;:90001A0000100014.0.7015.1000;:#90001A0000100014.0.7015.1000;:9100330000100014.0.7015.1000;:#9100330000100014.0.7015.1000;:9100110000100014.0.7015.1000;:#9100110000100014.0.7015.1000;:91011D0000100014.0.7015.1000;:#91011D0000100014.0.7015.1000;:9000110000100014.0.7015.1000;:#9000110000100014.0.7015.1000;:9100140000100014.0.7015.1000;:#9100140000100014.0.7015.1000;:90003D0000100014.0.7015.1000;:#90003D0000100014.0.7015.1000;:91008B0000100014.0.7015.1000;:#91008B0000100014.0.7015.1000;:90008B0000100014.0.7015.1000;:#90008B0000100014.0.7015.1000;:9100120000100014.0.7015.1000;:#9100120000100014.0.7015.1000;:9000120000100014.0.7015.1000;:#9000120000100014.0.7015.1000, Revision Number: {8DE9734B-FDEE-4ADA-8142-94D7B039EFE4}, Number of Words: 5, Name of Creating Application: Microsoft Patch Compiler
fmt-111-signature-id-170.nul: data
fmt-39-signature-id-128.doc: data
Geburtenrate.sdd: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Revision Number: 2, Total Editing Time: 20:34, Last Printed: 02:05, Last Saved Time/Date: Mon May 25 13:31:27 1998, Create Time/Date: Mon May 25 13:31:27 1998, Last Saved By: Gerald Leppert, Author: Gerald Leppert
Geschichte-der-NGOs-Schaubild.sdw: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Revision Number: 13, Total Editing Time: 01:19:30, Last Printed: Sun May 06 20:34:48 2001, Last Saved Time/Date: Sun May 06 20:34:54 2001, Create Time/Date: Sat May 05 20:52:39 2001, Last Saved By: Gerald Leppert, Author: Gerald Leppert
go-oox-3.sdw: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Code page: -535, Revision Number: 4, Last Printed: 02:05, Last Saved Time/Date: Fri Jan 06 09:19:46 2017, Create Time/Date: Mon Jul 10 17:04:56 2006, Author: Annerose Hümbert
go-oox-4.sdc: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Code page: -535, Revision Number: 2, Total Editing Time: 00:01, Last Printed: 02:05, Last Saved Time/Date: Fri Jan 06 09:37:19 2017, Create Time/Date: Tue Mar 20 16:16:44 2007, Author: windows-vm
go-oox-4.sdw: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Code page: -535, Revision Number: 4, Last Printed: 02:05, Last Saved Time/Date: Fri Jan 06 09:18:44 2017, Create Time/Date: Mon Jul 10 17:04:56 2006, Author: Annerose Hümbert
go-oox-5.sdc: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Code page: -535, Revision Number: 2, Total Editing Time: 00:02, Last Printed: 02:05, Last Saved Time/Date: Fri Jan 06 09:21:15 2017, Create Time/Date: Tue Mar 20 16:16:44 2007, Author: windows-vm
go-oox-5.sdd: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Code page: -535, Revision Number: 2, Last Printed: 02:05, Last Saved Time/Date: Fri Jan 06 09:38:50 2017, Create Time/Date: Fri Jan 06 09:38:50 2017
guidNull.ole2: Composite Document File V2 Document, Cannot read section info
guidunknown.ole2: Composite Document File V2 Document, Cannot read section info
harmless-clean.doc: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: user, Template: Normal, Last Saved By: user, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Oct 26 10:09:00 2017, Last Saved Time/Date: Thu Oct 26 10:09:00 2017, Number of Pages: 1, Number of Words: 39, Number of Characters: 250, Security: 0
HORSE_cph.cph: Composite Document File V2 Document, Cannot read section info
Internet-Assistent: Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Title: ', Author: (C) 1995 - 1998 Microsoft Corporation, Comments: Konvertiert Microsoft Excel-Tabellen und -Diagramme in HTML-Dateien., Last Saved By: Microsoft Corporation, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 27 22:43:05 1996, Security: 0
io-jp60.ppt: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.10, Title: Internet Hosts Reachable 1981-1993, Author: Rutkowski, Last Saved By: AUTHORIZED GATEWAY CUSTOMER, Revision Number: 51, Last Printed: *Bad* 0x0991d0582e30083e, Create Time/Date: *Bad* 0x0991d0582e2c3080, Last Saved Time/Date: *Bad* 0x060d8b982e3287c0, Number of Pages: 25, Name of Creating Application: Microsoft PowerPoint 4.0
KITECUST.WDB: Composite Document File V2 Document, Cannot read section info
LWE-Dublin.sda: Composite Document File V2 Document, Little Endian, Os 0, Version: 1.0, Revision Number: 2, Total Editing Time: 09:43, Last Saved Time/Date: Tue Apr 01 19:04:24 2003, Create Time/Date: Thu Dec 05 21:37:33 2002, Last Saved By:
med001_wh06.ppt: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: A Case Study On Designing and Implementing IR and Remote Solutions for Windows Vista Media Center Systems, Subject: Microsoft WinHEC 2006, Comments: Template design: Giulio P., Silver Fox Productions Formatter: Tony Scauzillo, Silver Fox Productions, Inc.Event Date:Event Location:Speech Length:Audience:Key Topics:© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION., Template: WinHec 2006 Slide Template, Revision Number: 84, Name of Creating Application: Microsoft PowerPoint, Total Editing Time: 21:51:03, Create Time/Date: *Bad* 0x07a12000441e67e7, Last Saved Time/Date: *Bad* 0x1331548044808384, Number of Words: 1220
Microsoft Office Project 2003 deployment.mpp: Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: Microsoft Office Project 2003 Deployment, Template: Microsoft Office Project 2003 deployment, Last Saved By: Marc, Revision Number: 1, Name of Creating Application: Microsoft Project, Create Time/Date: Fri Jul 23 21:34:00 2004, Last Saved Time/Date: Fri Jul 23 21:50:00 2004, Security: 0
MIMICFunctions.xla: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 936, Author: cyemparala, Last Saved By: Yongsheng Sun, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri May 21 21:58:08 2010, Last Saved Time/Date: Wed Feb 07 03:57:00 2018, Security: 0
MO-2003.xls: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: _, Last Saved By: _, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jul 22 00:23:38 2019, Last Saved Time/Date: Mon Jul 22 00:29:27 2019, Security: 0
MO-2003template.xlt: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: _, Last Saved By: _, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jul 22 00:23:38 2019, Last Saved Time/Date: Mon Jul 22 00:30:50 2019, Security: 0
msworks4.wdb: Composite Document File V2 Document, Cannot read section info
Outlook.srs: Composite Document File V2 Document, Cannot read section info
Outlook2003.msg: CDFV2 Microsoft Outlook Message
outlook2003template.oft: CDFV2 Microsoft Outlook Message
p97-2003autostart.pps: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Code page: -535, Title: Beehive, Author: Jörg Jenderek, Revision Number: 1, Create Time/Date: *Bad* 0x23b403c05cd36659
p97-2003template.pot: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Code page: -535, Title: Beehive, Author: Jörg Jenderek, Revision Number: 1, Create Time/Date: *Bad* 0x23b403c05cd36659
Populaeres Clip-Paket: Composite Document File V2 Document, Cannot read section info
powerpoint40brasil.ppt: Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Slide sem título , Author: , Template: C:\MSOffice\Modelos\Apresentação em Branco.pot, Last Saved By: , Name of Creating Application: Microsoft PowerPoint, Last Printed: -10519284d+-16:-21:-34, Create Time/Date: *Bad* 0x3a9763c02fe357a6, Last Saved Time/Date: *Bad* 0x363d7f805d372c4b, Number of Pages: 21770544
powerpoint95.ppt: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: title, Author: _, Last Saved By: _, Revision Number: 1, Name of Creating Application: Microsoft Office PowerPoint, Create Time/Date: *Bad* 0x32e701805d3655bb, Last Saved Time/Date: *Bad* 0x353a19405d3655ce, Number of Words: 1
powerpoint95brasil.pot: Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Title: Slide sem título , Author: , Template: C:\MSOffice\Modelos\Apresentação em Branco.pot, Last Saved By: , Revision Number: 1, Name of Creating Application: Microsoft PowerPoint, Total Editing Time: 02:27, Create Time/Date: *Bad* 0x3a9763c02fe357a6, Last Saved Time/Date: *Bad* 0x07bfa4805d372bff, Number of Words: 0
Presentation7-x3.mst: Composite Document File V2 Document, Little Endian, Os 0, Version: 6.2Composite Document File V2 Document, Cannot read section info
Presentation7-x3.shw: Composite Document File V2 Document, Little Endian, Os 0, Version: 6.2Composite Document File V2 Document, Cannot read section info
PublisherMuster_quer98.pub: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Jenderek
s-chart3.sds: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Thu Jul 18 01:15:08 2019, Author:
s-chart4.sds: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Thu Jul 18 01:15:08 2019, Author:
s-chart5.sds: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Thu Jul 18 01:15:08 2019, Author:
s-draw3.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:52, Last Printed: 06:31, Last Saved Time/Date: Tue May 21 14:09:15 2019, Create Time/Date: Tue May 21 14:08:24 2019
s-draw5.0.sda: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:52, Last Printed: 06:31, Last Saved Time/Date: Tue May 21 14:09:15 2019, Create Time/Date: Tue May 21 14:08:24 2019
s-draw5.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:52, Last Printed: 06:31, Last Saved Time/Date: Tue May 21 14:09:15 2019, Create Time/Date: Tue May 21 14:08:24 2019
s-math3.smf: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:54, Last Printed: 06:31, Last Saved Time/Date: Thu Jul 18 01:33:54 2019, Create Time/Date: Thu Jul 18 01:33:00 2019, Last Saved By: , Author:
scalc-3.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:41, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 12:58:40 2019, Create Time/Date: Mon May 20 12:57:59 2019
scalc-4.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:41, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 12:58:40 2019, Create Time/Date: Mon May 20 12:57:59 2019
scalc-5.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:41, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 12:58:40 2019, Create Time/Date: Mon May 20 12:57:59 2019
sg24.sdv: Composite Document File V2 Document, Cannot read section info
simpress4.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:51, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 19:30:59 2019, Create Time/Date: Mon May 20 19:30:18 2019
simpress5.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 00:51, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 19:30:59 2019, Create Time/Date: Mon May 20 19:30:18 2019
SLIDES.XLT: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.10, Title: Slideshow Template, Author: Microsoft Corp., Comments: Use this to create a slideshow from worksheets and charts., Name of Creating Application: Microsoft Excel, Security: 0
smaster4.0.sgl: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Tue May 21 14:14:17 2019
smaster5.0.sgl: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Tue May 21 14:14:17 2019
smath4.0.smf: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Tue May 21 23:45:12 2019
smath5.0.smf: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 1, Last Printed: 06:31, Last Saved Time/Date: 06:31, Create Time/Date: Tue May 21 23:45:12 2019
soffice-3.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 01:54, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 04:23:17 2019, Create Time/Date: Mon May 20 04:21:53 2019
soffice-4.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 01:54, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 04:23:17 2019, Create Time/Date: Mon May 20 04:21:53 2019
soffice-5.0template.vor: Composite Document File V2 Document, Little Endian, Os: Windows, Version 1.0, Revision Number: 2, Total Editing Time: 01:54, Last Printed: 06:31, Last Saved Time/Date: Mon May 20 04:23:17 2019, Create Time/Date: Mon May 20 04:21:53 2019
Stellar Conquest.wps: Composite Document File V2 Document, Cannot read section info
surfnet-keynote.doc: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.10, Template: C:\WINWORD\TEMPLATE\NORMAL.DOT, Title: Keynote Address, Author: AUTHORIZED GATEWAY CUSTOMER, Last Saved By: AUTHORIZED GATEWAY CUSTOMER, Create Time/Date: *Bad* 0x000868582ed0b3d4, Last Printed: *Bad* 0x000868582ed0b71c, Last Saved Time/Date: *Bad* 0x000868582ed0cfb8, Number of Words: 0, Number of Characters: 0, Total Editing Time: 51:00, Name of Creating Application: Microsoft Word 6.0, Number of Pages: 0, Revision Number: 7, Security: 0
test-italian.xls: CDFV2 Microsoft Excel
testChartForm.sdc: Composite Document File V2 Document, Little Endian, Os: MacOS, Version 0.1, Last Saved By: alonso laurent, Author: alonso laurent
THUMBS.DB: Composite Document File V2 Document, Cannot read section info
Thumbs_256.db: Composite Document File V2 Document, Cannot read section info
Thumbs_96.db: Composite Document File V2 Document, Cannot read section info
TMPL838.PS: Composite Document File V2 Document, Cannot read section info
TMPL840.DB: Composite Document File V2 Document, Cannot read section info
VBA-Schluesselwoerterliste: Composite Document File V2 Document, Little Endian, Os: MacOS, Version 7.17, Title: VBA SchŸsselwšrter, Author: Markus Ramirez, Name of Creating Application: Microsoft Excel, Security: 0, Code page: 10000
Visio2002Test.vsd: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: dtobias, Name of Creating Application: Microsoft Visio
Visio2002Test.vss: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: dtobias, Name of Creating Application: Microsoft Visio
Visio2002Test.vst: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: dtobias, Name of Creating Application: Microsoft Visio
VisioTest.vsd: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: dtobias, Last Saved By: dtobias, Name of Creating Application: Microsoft Visio, Last Saved Time/Date: *Bad* 0x244c9a40533db01a
W-30W.BDB: Composite Document File V2 Document, Cannot read section info
W-WP.BPS: Composite Document File V2 Document, Cannot read section info
wks45pop.cag: Composite Document File V2 Document, Cannot read section info
wm98.nfo: Composite Document File V2 Document, Little Endian, Os: Windows, Version 4.10, Code page: 1252, Comments: Datum/Uhrzeit = 20.12.18 22:50:14Computername = VM98Benutzername = joergDie Datei enthält Informationen über folgende Steuerelemente:Datei EYEDOG.OCX (Version 1.1.1.75, 170496 Bytes)Datei MSICDROM.OCX (Version 4.10.0.1998, 43520 Bytes)Datei MSUPDATE.OCX (Version 4.10.0.2222, 30720 Bytes)Datei IEINFO5.OCX (Version 5.50.4807.2300, 104208 Bytes)Datei MSISYS.OCX (Version 1.0.0.1, 138240 Bytes)Datei MSIPRINT.OCX (Version 4.10.0.1998, 34304 Bytes)Datei MSIOLERG.OCX (Version 4.10.0.1998, 35840 Bytes)Datei MSIAV.OCX (Version 4.10.0.1998, 38912 Bytes), Revision Number: 0, Number of Pages: 0, Number of Words: 0, Number of Characters: 0, Name of Creating Application: Microsoft Systeminfo, Security: 0
WORD60ES.DOC: Composite Document File V2 Document, Little Endian, Os 0, Version: 3.95, Template: NORMAL.DOT, Title: title_60, Subject: subject_6.0, Keywords: keword_6.0, Comments: winword 6.0, Author: win98se, Last Saved By: win98se, Create Time/Date: Fri Mar 24 04:05:00 2017, Last Printed: Fri Dec 31 00:00:00 2027, Last Saved Time/Date: Fri Mar 24 04:05:00 2017, Number of Words: 1, Number of Characters: 11, Name of Creating Application: Microsoft Word 6.0, Number of Pages: 1, Revision Number: 1, Security: 0
Word97_dot.dot: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: This is my Word 97 Document, Author: djc, Template: Word97_dot.dot, Last Saved By: djc, Revision Number: 2, Name of Creating Application: Microsoft Word 8.0, Create Time/Date: Fri Apr 10 15:01:00 2015, Last Saved Time/Date: Fri Apr 10 15:01:00 2015, Number of Pages: 1, Number of Words: 4, Number of Characters: 23, Security: 0
wordperfect-7-x3conture.wpd: Composite Document File V2 Document, Cannot read section info
wordperfect-7-x3grafic.wpg: Composite Document File V2 Document, Cannot read section info
works-excel97-2003.xls: CDFV2 Microsoft Excel
works6-8.xlr: CDFV2 Microsoft Excel
works6.wps: Composite Document File V2 Document, Cannot read section info
x-fmt-430-signature-id-208.msg: data
x-fmt-88-signature-id-181.ppt: data
-------------- next part --------------
100723-.hwp: OLE 2 Compound Document, v3.62, SecID 0x2 : Hangul (Korean) 5.0 Word Processor File
1344468165.dgn: OLE 2 Compound Document, v3.62, SecID 0x1 : Microstation V8 DGN
15.11.10_Schiwy.msg: OLE 2 Compound Document, v3.62, SecID 0x0 : Microsoft Outlook 97-2003 item
3-Spalten-Layout: OLE 2 Compound Document, v3.62, SecID 0x28 : Microsoft Word 97-2003 document or template
7z1806.msi: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Windows Installer Package
9_by_6_fullcpy_preview.wps: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 4 document
ANALYSIS.XLA: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Excel 5-95 worksheet, addin or template
AusweisApp2-1.16.1.msi: OLE 2 Compound Document, v4.62, SecID 0x1, blocksize 4096 : Microsoft Windows Installer Package
b7ea.rra: OLE 2 Compound Document, v3.62, SecID 0x1 : Windows temporarily installer
BALOU_C.WPS: OLE 2 Compound Document, v3.31, SecID 0x7 : Microsoft Works 3.0 document
Barham, Lisa - Die Shopping-Prinzessinnen.doc: OLE 2 Compound Document, v3.62, SecID 0x3144 too big for FILE_BYTES_MAX = 1 MiB
DINASAUR.CPH: OLE 2 Compound Document, v3.62, SecID 0x1 : Corel PrintHouse image
DOT60.DOT: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Word 6-95 document or template
Elternabend1998.sdd: OLE 2 Compound Document, v3.59, SecID 0x2b : StarOffice StarDraw 3.0 drawing or template
EXPTOOWS.XLA: OLE 2 Compound Document, v3.62, SecID 0x8b : Microsoft Excel 97-2003 addin
f01b4d95cf55d32a.automaticDestinations-ms: OLE 2 Compound Document, v3.62, SecID 0x1 : Windows jump list
f278646.msp: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Windows Installer Patch
fmt-111-signature-id-170.nul: data
fmt-39-signature-id-128.doc: data
Geburtenrate.sdd: OLE 2 Compound Document, v3.59, SecID 0x40 : StarOffice StarImpress 4.0 presentation or template
Geschichte-der-NGOs-Schaubild.sdw: OLE 2 Compound Document, v3.59, SecID 0x39 : StarOffice StarWriter 5.0 document or template
go-oox-3.sdw: OLE 2 Compound Document, v3.59, SecID 0x78 : StarOffice StarWriter 3.0 document or template
go-oox-4.sdc: OLE 2 Compound Document, v3.59, SecID 0xf6 : StarOffice StarCalc 4.0 spreadsheet or template
go-oox-4.sdw: OLE 2 Compound Document, v3.59, SecID 0x84 : StarOffice StarWriter 4.0 document or template
go-oox-5.sdc: OLE 2 Compound Document, v3.59, SecID 0xc6 : StarOffice StarCalc 5.0 spreadsheet or template
go-oox-5.sdd: OLE 2 Compound Document, v3.59, SecID 0x5b : StarOffice StarImpress 5.0 presentation or template
guidNull.ole2: OLE 2 Compound Document, v3.62, SecID 0x1 : UNKNOWN
guidunknown.ole2: OLE 2 Compound Document, v3.62, SecID 0x1 : UNKNOWN, clsid 0x5a595857565554525351313233343536
harmless-clean.doc: OLE 2 Compound Document, v3.62, SecID 0x28 : Microsoft Word 97-2003 document or template
HORSE_cph.cph: OLE 2 Compound Document, v3.62, SecID 0x0 : Corel PrintHouse image
Internet-Assistent: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Excel 97-2003 addin
io-jp60.ppt: OLE 2 Compound Document, v3.59, SecID 0x98 : Microsoft PowerPoint 4 presentation
KITECUST.WDB: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Works 3-4 database or template
LWE-Dublin.sda: OLE 2 Compound Document, v3.59, SecID 0x98 : StarOffice StarImpress 5.0 presentation or template
med001_wh06.ppt: OLE 2 Compound Document, v3.62, SecID 0x5bd : Microsoft PowerPoint 97-2003 presentation or template
Microsoft Office Project 2003 deployment.mpp: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Project
MIMICFunctions.xla: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Excel 97-2003 addin
MO-2003.xls: OLE 2 Compound Document, v3.62, SecID 0x19 : Microsoft Excel 97-2003 worksheet or template
MO-2003template.xlt: OLE 2 Compound Document, v3.62, SecID 0x19 : Microsoft Excel 97-2003 worksheet or template
msworks4.wdb: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 4 database
Outlook.srs: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Outlook Send Receive Settings
Outlook2003.msg: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Outlook 97-2003 item
outlook2003template.oft: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Outlook 97-2003 item template
p97-2003autostart.pps: OLE 2 Compound Document, v3.59, SecID 0x39e : Microsoft PowerPoint 97-2003 presentation or template
p97-2003template.pot: OLE 2 Compound Document, v3.59, SecID 0x39e : Microsoft PowerPoint 97-2003 presentation or template
Populaeres Clip-Paket: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Clip Art Gallery
powerpoint40brasil.ppt: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft PowerPoint 4.0 presentation
powerpoint95.ppt: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft PowerPoint 95 presentation
powerpoint95brasil.pot: OLE 2 Compound Document, v3.62, SecID 0x3a : Microsoft PowerPoint 95 presentation
Presentation7-x3.mst: OLE 2 Compound Document, v3.62, SecID 0x1 : WordPerfect 7-X3 presentations Master, Document or Graphic
Presentation7-x3.shw: OLE 2 Compound Document, v3.62, SecID 0x1 : WordPerfect 7-X3 presentation
PublisherMuster_quer98.pub: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Publisher
s-chart3.sds: OLE 2 Compound Document, v3.59, SecID 0x4c : StarOffice StarChart 3.0
s-chart4.sds: OLE 2 Compound Document, v3.59, SecID 0x4d : StarOffice StarChart 4.0
s-chart5.sds: OLE 2 Compound Document, v3.59, SecID 0x4e : StarOffice StarChart 5.0
s-draw3.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x3e : StarOffice StarDraw 3.0 drawing or template
s-draw5.0.sda: OLE 2 Compound Document, v3.59, SecID 0x39 : StarOffice StarDraw 5.0 drawing or template
s-draw5.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x3a : StarOffice StarDraw 5.0 drawing or template
s-math3.smf: OLE 2 Compound Document, v3.59, SecID 0x7 : StarOffice StarMath 3.0
scalc-3.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x27 : StarOffice StarCalc 3.0 spreadsheet or template
scalc-4.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x27 : StarOffice StarCalc 4.0 spreadsheet or template
scalc-5.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x28 : StarOffice StarCalc 5.0 spreadsheet or template
sg24.sdv: OLE 2 Compound Document, v3.59, SecID 0x1 : StarOffice Gallery view
simpress4.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x40 : StarOffice StarImpress 4.0 presentation or template
simpress5.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x3a : StarOffice StarImpress 5.0 presentation or template
SLIDES.XLT: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Excel 5-95 worksheet, addin or template
smaster4.0.sgl: OLE 2 Compound Document, v3.59, SecID 0x17 : StarOffice Master 4.0 document
smaster5.0.sgl: OLE 2 Compound Document, v3.59, SecID 0x18 : StarOffice Master 5.0 document
smath4.0.smf: OLE 2 Compound Document, v3.59, SecID 0x8 : StarOffice StarMath 4.0
smath5.0.smf: OLE 2 Compound Document, v3.59, SecID 0x8 : StarOffice StarMath 5.0
soffice-3.0template.vor: OLE 2 Compound Document, v3.59, SecID 0xb : StarOffice StarWriter 3.0 document or template
soffice-4.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x16 : StarOffice StarWriter 4.0 document or template
soffice-5.0template.vor: OLE 2 Compound Document, v3.59, SecID 0x16 : StarOffice StarWriter 5.0 document or template
Stellar Conquest.wps: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Works 3-4 document or template
surfnet-keynote.doc: OLE 2 Compound Document, v3.59, SecID 0x0 : Microsoft Word 6-95 document or template
test-italian.xls: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Excel 5-95 worksheet, addin or template
testChartForm.sdc: OLE 2 Compound Document, v3.59, SecID 0x64 : StarOffice StarCalc 3.0 spreadsheet or template
THUMBS.DB: OLE 2 Compound Document, v3.62, SecID 0x1 : Windows thumbnail database
Thumbs_256.db: OLE 2 Compound Document, v3.62, SecID 0x1 : Windows thumbnail database 256
Thumbs_96.db: OLE 2 Compound Document, v3.62, SecID 0x1 : Windows thumbnail database 96
TMPL838.PS: OLE 2 Compound Document, v3.50, SecID 0x1 : Microsoft Works 3-4 document or template
TMPL840.DB: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Works 3-4 database or template
VBA-Schluesselwoerterliste: OLE 2 Compound Document, v3.59, SecID 0x1 : Microsoft Excel 5-95 worksheet, addin or template
Visio2002Test.vsd: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Visio 2000-2002 Document, stencil or template
Visio2002Test.vss: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Visio 2000-2002 Document, stencil or template
Visio2002Test.vst: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Visio 2000-2002 Document, stencil or template
VisioTest.vsd: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Visio 2003-2010 Document, stencil or template
W-30W.BDB: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 3-4 database or template
W-WP.BPS: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 3-4 document or template
wks45pop.cag: OLE 2 Compound Document, v3.62, SecID 0x2 : Microsoft Clip Art Gallery
wm98.nfo: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft old Systeminfo
WORD60ES.DOC: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Word 6-95 document or template
Word97_dot.dot: OLE 2 Compound Document, v3.62, SecID 0x21 : Microsoft Word 97-2003 document or template
wordperfect-7-x3conture.wpd: OLE 2 Compound Document, v3.62, SecID 0x2 : WordPerfect 7-X3 presentations Master, Document or Graphic
wordperfect-7-x3grafic.wpg: OLE 2 Compound Document, v3.62, SecID 0x2 : WordPerfect 7-X3 presentations Master, Document or Graphic
works-excel97-2003.xls: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Excel 97-2003 worksheet 0 clsid
works6-8.xlr: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 6-9 spreadsheet
works6.wps: OLE 2 Compound Document, v3.62, SecID 0x1 : Microsoft Works 5-6 document
x-fmt-430-signature-id-208.msg: data
x-fmt-88-signature-id-181.ppt: data
-------------- next part --------------
100723-.hwp: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
1344468165.dgn: OLE 2 Compound Document : Microstation V8 DGN\012- data
15.11.10_Schiwy.msg: Microsoft Word Document\012- Hangul (Korean) Word Processor File 2000\012- OLE 2 Compound Document\012- (Lepton 3.x), scale 261-0, spot sensor temperature 0.000000, color scheme 3, calibration: offset 0.000000, slope 0.000000\012- data
3-Spalten-Layout: OLE 2 Compound Document : Microsoft Word Document\012- data
7z1806.msi: OLE 2 Compound Document\012- data
9_by_6_fullcpy_preview.wps: OLE 2 Compound Document\012- data
ANALYSIS.XLA: Microsoft Excel 5.0 Worksheet\012- OLE 2 Compound Document\012- Microsoft Excel 5.0 Worksheet\012- (Lepton 2.x), scale 0-62975, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- (Lepton 3.x), scale 0-258, spot sensor temperature 0.000000, unit celsius, color scheme 5, minimum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
AusweisApp2-1.16.1.msi: OLE 2 Compound Document\012- data
b7ea.rra: OLE 2 Compound Document\012- (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
BALOU_C.WPS: OLE 2 Compound Document\012- data
Barham, Lisa - Die Shopping-Prinzessinnen.doc: OLE 2 Compound Document : Microsoft Word Document\012- data
DINASAUR.CPH: OLE 2 Compound Document\012- data
DOT60.DOT: Microsoft Word 6.0 Document\012- Microsoft Word document data\012- OLE 2 Compound Document\012- data
Elternabend1998.sdd: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-22578, spot sensor temperature 864.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
EXPTOOWS.XLA: OLE 2 Compound Document\012- data
f01b4d95cf55d32a.automaticDestinations-ms: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope -13950337024.000000\012- data
f278646.msp: OLE 2 Compound Document\012- (Lepton 2.x), scale 491-2291, spot sensor temperature -10334032096831827000000000000000.000000, color scheme 15, show spot sensor, minimum point enabled, maximum point enabled, calibration: offset -1050.273804, slope 1678094893056.000000\012- data
fmt-111-signature-id-170.nul: OLE 2 Compound Document\012- data
fmt-39-signature-id-128.doc: OLE 2 Compound Document\012- data
Geburtenrate.sdd: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
Geschichte-der-NGOs-Schaubild.sdw: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
go-oox-3.sdw: OLE 2 Compound Document\012- data
go-oox-4.sdc: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-20480, spot sensor temperature 0.000000, color scheme 4, show scale bar, calibration: offset 0.000000, slope 0.000000\012- data
go-oox-4.sdw: OLE 2 Compound Document\012- (Lepton 3.x), scale 9508-1317, spot sensor temperature 0.000000, color scheme 7, minimum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
go-oox-5.sdc: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-50, spot sensor temperature 0.000000, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- (Lepton 3.x), scale 7424-46848, spot sensor temperature 0.000000, color scheme 0, maximum point enabled, calibration: offset 17884519199828246000000.000000, slope 0.000000\012- data
go-oox-5.sdd: OLE 2 Compound Document\012- (Lepton 2.x), scale 768-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
guidNull.ole2: OLE 2 Compound Document\012- data
guidunknown.ole2: OLE 2 Compound Document\012- data
harmless-clean.doc: OLE 2 Compound Document : Microsoft Word Document\012- data
HORSE_cph.cph: Microsoft Word Document\012- Hangul (Korean) Word Processor File 2000\012- OLE 2 Compound Document\012- data
Internet-Assistent: OLE 2 Compound Document\012- data
io-jp60.ppt: OLE 2 Compound Document\012- (Lepton 2.x), scale 1024-0, spot sensor temperature 0.000000, unit celsius, color scheme 4, calibration: offset 0.000000, slope -2658455991569831700000000000000000000.000000\012- (Lepton 3.x), scale 4672-770, spot sensor temperature 0.000000, unit celsius, color scheme 2, maximum point enabled, calibration: offset 26038238.000000, slope 0.000000\012- data
KITECUST.WDB: OLE 2 Compound Document\012- (Lepton 2.x), scale 24942-25600, spot sensor temperature 0.000000, unit celsius, color scheme 3, maximum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
LWE-Dublin.sda: OLE 2 Compound Document\012- (Lepton 3.x), scale 512-1536, spot sensor temperature 0.000000, unit celsius, color scheme 1, minimum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
med001_wh06.ppt: OLE 2 Compound Document\012- data
Microsoft Office Project 2003 deployment.mpp: OLE 2 Compound Document\012- data
MIMICFunctions.xla: OLE 2 Compound Document\012- (Lepton 3.x), scale 25600-26880, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
MO-2003.xls: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
MO-2003template.xlt: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
msworks4.wdb: OLE 2 Compound Document\012- data
Outlook.srs: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
Outlook2003.msg: Microsoft Word Document\012- Hangul (Korean) Word Processor File 2000\012- OLE 2 Compound Document\012- data
outlook2003template.oft: Microsoft Word Document\012- Hangul (Korean) Word Processor File 2000\012- OLE 2 Compound Document\012- data
p97-2003autostart.pps: OLE 2 Compound Document\012- (Lepton 2.x), scale 16723-26638, spot sensor temperature 940.399902, color scheme 4, minimum point enabled, maximum point enabled, calibration: offset -36236.828125, slope -13821374464.000000\012- (Lepton 3.x), scale 6260-7552, spot sensor temperature 911677.625000, color scheme 9, maximum point enabled, calibration: offset 0.000000, slope 144063480960766170000000000000000000000.000000\012- data
p97-2003template.pot: OLE 2 Compound Document\012- (Lepton 2.x), scale 16723-26638, spot sensor temperature 940.399902, color scheme 4, minimum point enabled, maximum point enabled, calibration: offset -36236.828125, slope -13821374464.000000\012- (Lepton 3.x), scale 6260-7552, spot sensor temperature 911677.625000, color scheme 9, maximum point enabled, calibration: offset 0.000000, slope 144063480960766170000000000000000000000.000000\012- data
Populaeres Clip-Paket: OLE 2 Compound Document\012- data
powerpoint40brasil.ppt: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
powerpoint95.ppt: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-61191, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
powerpoint95brasil.pot: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
Presentation7-x3.mst: OLE 2 Compound Document\012- data
Presentation7-x3.shw: OLE 2 Compound Document\012- (Lepton 2.x), scale 19-224, spot sensor temperature 0.000000, color scheme 3, calibration: offset 0.000000, slope 0.000000\012- (Lepton 3.x), scale 240-24511, spot sensor temperature -16380928.000000, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
PublisherMuster_quer98.pub: OLE 2 Compound Document\012- data
s-chart3.sds: OLE 2 Compound Document\012- (Lepton 2.x), scale 22547-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- (Lepton 3.x), scale 73-73, spot sensor temperature 2097216.000000, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
s-chart4.sds: OLE 2 Compound Document\012- (Lepton 3.x), scale 2048-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 537001984.000000, slope -1.#QNAN0\012- data
s-chart5.sds: OLE 2 Compound Document\012- data
s-draw3.0template.vor: OLE 2 Compound Document\012- data
s-draw5.0.sda: OLE 2 Compound Document\012- data
s-draw5.0template.vor: OLE 2 Compound Document\012- data
s-math3.smf: OLE 2 Compound Document\012- data
scalc-3.0template.vor: OLE 2 Compound Document\012- data
scalc-4.0template.vor: OLE 2 Compound Document\012- (Lepton 2.x), scale 4015-4016, spot sensor temperature -0.000000, color scheme 15, calibration: offset 0.000000, slope 0.000000\012- data
scalc-5.0template.vor: OLE 2 Compound Document\012- (Lepton 2.x), scale 4014-4015, spot sensor temperature -0.000000, color scheme 15, minimum point enabled, maximum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
sg24.sdv: OLE 2 Compound Document\012- (Lepton 3.x), scale 512-365, spot sensor temperature 0.000000, color scheme 1, show spot sensor, maximum point enabled, calibration: offset 0.000000, slope 0.000000\012- data
simpress4.0template.vor: OLE 2 Compound Document\012- data
simpress5.0template.vor: OLE 2 Compound Document\012- (Lepton 2.x), scale 78-768, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
SLIDES.XLT: Microsoft Excel 5.0 Worksheet\012- OLE 2 Compound Document\012- Microsoft Excel 5.0 Worksheet\012- data
smaster4.0.sgl: OLE 2 Compound Document\012- data
smaster5.0.sgl: OLE 2 Compound Document\012- data
smath4.0.smf: OLE 2 Compound Document\012- data
smath5.0.smf: OLE 2 Compound Document\012- data
soffice-3.0template.vor: OLE 2 Compound Document\012- data
soffice-4.0template.vor: OLE 2 Compound Document\012- data
soffice-5.0template.vor: OLE 2 Compound Document\012- data
Stellar Conquest.wps: OLE 2 Compound Document\012- data
surfnet-keynote.doc: Microsoft Word Document\012- Hangul (Korean) Word Processor File 2000\012- OLE 2 Compound Document\012- data
test-italian.xls: Foglio di lavoro Microsoft Exce\012- OLE 2 Compound Document\012- Microsoft Excel 5.0 Worksheet\012- data
testChartForm.sdc: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 2.250000, unit celsius, color scheme 1, show spot sensor, calibration: offset 0.000000, slope 0.000000\012- data
THUMBS.DB: OLE 2 Compound Document\012- data
Thumbs_256.db: OLE 2 Compound Document\012- data
Thumbs_96.db: OLE 2 Compound Document\012- data
TMPL838.PS: OLE 2 Compound Document\012- data
TMPL840.DB: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
VBA-Schluesselwoerterliste: Microsoft Excel 5.0 Worksheet\012- OLE 2 Compound Document\012- (Lepton 2.x), scale 2-0, spot sensor temperature 0.000000, color scheme 2, calibration: offset 0.000000, slope 0.000000\012- (Lepton 3.x), scale 535-49, spot sensor temperature 0.000000, color scheme 0, minimum point enabled, calibration: offset 1186587107689272100000000000.000000, slope 1128049685785288100000000000.000000\012- data
Visio2002Test.vsd: OLE 2 Compound Document\012- (Lepton 2.x), scale 42497-0, spot sensor temperature 0.000000, unit celsius, color scheme 5, calibration: offset -616140237701120.000000, slope 626035842351104.000000\012- (Lepton 3.x), scale 18392-942, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset -582528348630886070000000000000.000000, slope 0.000000\012- data
Visio2002Test.vss: OLE 2 Compound Document\012- (Lepton 2.x), scale 42497-0, spot sensor temperature 0.000000, unit celsius, color scheme 5, calibration: offset -616140237701120.000000, slope 626035842351104.000000\012- data
Visio2002Test.vst: OLE 2 Compound Document\012- (Lepton 2.x), scale 42497-0, spot sensor temperature 0.000000, unit celsius, color scheme 5, calibration: offset -616140237701120.000000, slope 626035842351104.000000\012- data
VisioTest.vsd: OLE 2 Compound Document\012- (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, color scheme 0, calibration: offset -148053752403033600000000000.000000, slope -581947308658833790000000000000.000000\012- data
W-30W.BDB: OLE 2 Compound Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
W-WP.BPS: OLE 2 Compound Document\012- data
wks45pop.cag: OLE 2 Compound Document\012- data
wm98.nfo: OLE 2 Compound Document\012- (Lepton 2.x), scale 33823-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset -0.000031, slope 33554464.000000\012- data
WORD60ES.DOC: Spanish Microsoft Word 6 document data\012- Microsoft Word document data\012- OLE 2 Compound Document\012- data
Word97_dot.dot: OLE 2 Compound Document : Microsoft Word Document\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
wordperfect-7-x3conture.wpd: OLE 2 Compound Document\012- (Lepton 2.x), scale 19-224, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000\012- data
wordperfect-7-x3grafic.wpg: OLE 2 Compound Document\012- data
works-excel97-2003.xls: OLE 2 Compound Document\012- (Lepton 2.x), scale 48-46, spot sensor temperature 144326294308388860.000000, color scheme 0, calibration: offset 0.000000, slope -0.000000\012- data
works6-8.xlr: OLE 2 Compound Document\012- (Lepton 2.x), scale 48-92, spot sensor temperature 0.000000, color scheme 4, calibration: offset -0.000000, slope 0.000000\012- data
works6.wps: OLE 2 Compound Document\012- data
x-fmt-430-signature-id-208.msg: OLE 2 Compound Document\012- data
x-fmt-88-signature-id-181.ppt: OLE 2 Compound Document\012- data
-------------- next part --------------
--- file-5.37/magic/Magdir/ole2compounddocs.old 2019-04-19 00:42:27 +0000
+++ file-5.37/magic/Magdir/ole2compounddocs 2019-07-28 16:19:53 +0000
@@ -1,33 +1,471 @@
-
-#------------------------------------------------------------------------------
-# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $
-# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
-# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
-# Additional tests for OLE 2 Compound Documents should be under this recipe.
-
-0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
-# - Microstation V8 DGN files (www.bentley.com)
-# Last update on 10/23/2006 by Lester Hightower
-> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
-# - Visio documents
-# Last update on 10/23/2006 by Lester Hightower
-> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
-
-# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017
-# Update: Joerg Jenderek
-# from https://filext.com by Derek M Jones <derek at knosof.co.uk>
-# False positive with PPT (also currently this string is too long)
-#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
-#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document
-#>48 byte 0x1B Excel Document
-#!:mime application/vnd.ms-excel
->546 string bjbj : Microsoft Word Document
-!:mime application/msword
-# https://www.macdisk.com/macsigen.php
-!:apple MSWDWDBN
-!:ext doc/dot
->546 string jbjb : Microsoft Word Document
-!:mime application/msword
-!:apple MSWDWDBN
-!:ext doc
-
+
+#------------------------------------------------------------------------------
+# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $
+# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
+# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
+# Additional tests for OLE 2 Compound Documents should be under this recipe.
+# reference: https://www.openoffice.org/sc/compdocfileformat.pdf
+
+0 string \320\317\021\340\241\261\032\341
+# https://digital-preservation.github.io/droid/
+# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
+>0x1A ushort !0xABAB OLE 2 Compound Document
+#>0x1C uleshort x \b, endnian 0x%4.4x
+# big endian not tested
+>>0x1C ubeshort =0xfffe \b, big-endian
+>>>546 string jbjb : Microsoft Word Document
+!:mime application/msword
+!:apple MSWDWDBN
+!:ext doc
+# Byte Order 0xFFFE means little-endian found in real world applications
+#>>0x1C uleshort =0xfffe \b, little-endian
+>>0x1C uleshort =0xfffe
+# From: Joerg Jenderek
+# Major Version 3 or 4
+>>>0x1A uleshort x \b, v%u
+# Minor Version 32h=50 3Bh=59 3Eh=62
+>>>0x18 uleshort x \b.%u
+# SecID of first sector of the directory stream is often 1 but high like 3144h
+>>>48 ulelong x \b, SecID 0x%x
+# pointer to root entry only works with standard configuration for SecID ~< 800h
+# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
+# "ORLEN Factbook 2017.xls" XnView_metadata.doc
+# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
+>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
+# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
+>>>0x1E uleshort 0xc \b, blocksize 4096
+# jump to one block (4096 bytes per block) before root storage block
+>>>>(48.l*4096) ubyte x
+>>>>>&4095 use ole2-directory
+#>>>0x1E uleshort 9 \b, blocksize 512
+>>>0x1E uleshort 9
+# jump to one block (512 bytes per block) before root storage block
+# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
+>>>>(48.l*512) ubyte x
+>>>>>&511 use ole2-directory
+# check directory entry structure and display types by GUID
+0 name ole2-directory
+# directory entry name like "Root Entry"
+#>0 lestring16 x \b, 1st %.10s
+# type of the entry; 5~Root storage
+#>66 ubyte x \b, type %x
+# node colour of the entry: 00H ~ Red 01H ~ Black
+#>67 ubyte x \b, color %x
+# the DirIDs of the child nodes. Should both be –1 in the root storage entry
+#>68 bequad !0xffffffffffffffff \b, DirIDs %llx
+# second directory entry name like VisioDocument Control000
+#>128 lestring16 x \b, 2nd %.20s
+# third directory entry like WordDocument
+#>256 lestring16 x \b, 3rd %.20s
+# forth
+#>384 lestring16 x \b, 4th %.10s
+# 5th
+#>512 lestring16 x \b, 5th %.10s
+# 6th
+#>640 lestring16 x \b, 6th %.10s
+# 7th
+#>768 lestring16 x \b, 7th %.10s
+# https://wikileaks.org/ciav7p1/cms/page_13762814.html
+# https://m.blog.naver.com/superman4u/40047693679
+# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
+# http://www.windowstricks.in/online-windows-guid-converter
+#>80 ubequad !0 \b, clsid 0x%16.16llx
+#>>88 ubequad x \b%16.16llx
+# test for "Root Entry" inside directory by type 5 value
+>66 ubyte 5
+# look for CLSID GUID 0
+>>88 ubequad 0x0
+>>>80 ubequad 0x0
+# - Microstation V8 DGN files (www.bentley.com)
+# URL: https://en.wikipedia.org/wiki/MicroStation
+# Last update on 10/23/2006 by Lester Hightower
+# 07/24/2019 by Joerg Jenderek
+# Second directory entry name like Dgn~H Dgn~S
+>>>>128 lestring16 Dgn~ : Microstation V8 CAD
+#!:mime application/x-ole-storage
+!:mime application/x-bentley-dgn
+# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
+!:ext dgn
+#
+# URL: http://fileformats.archiveteam.org/wiki/WordPerfect
+# Second directory entry name PerfectOffice_
+>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic
+!:mime application/vnd.wordperfect
+# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
+!:apple ????WPC7
+!:ext mst/wpd/wpg
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+# Second directory entry name MatOST_
+>>>>128 lestring16 MatOST : Microsoft Works 3.0 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
+# 3rd directory entry name WksSSWorkBook
+>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet
+!:mime application/vnd.ms-works
+!:apple ????AWSS
+!:ext xlr
+#
+# URL: http://fileformats.archiveteam.org/wiki/XLS
+# what is the difference to {00020820-0000-0000-c000-000000000046} ?
+# Second directory entry name Workbook
+>>>>128 lestring16 Workbook
+>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
+!:apple ????XLS9
+!:ext xls
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+# Second directory entry name Object1 Object12 Object35
+>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt
+#
+# URL: https://www.msoutlook.info/question/164
+# Second directory entry name __CollDataStm
+>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-srs
+# %APPDATA%\Microsoft\Outlook\Outlook.srs
+!:ext srs
+#
+# URL: https://www.file-extensions.org/cag-file-extension
+# Second directory entry name Category
+>>>>128 lestring16 Category : Microsoft Clip Art Gallery
+#!:mime application/x-ole-storage
+!:mime application/x-ms-cag
+!:apple MScgCGdb
+!:ext cag/
+#
+# URL: https://www.filesuffix.com/de/extension/rra
+# 3rd directory entry name StrIndex_StringTable
+>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer
+#!:mime application/x-ole-storage
+!:mime application/x-ms-rra
+!:ext rra
+#
+# URL: https://www.forensicswiki.org/wiki/Jump_Lists
+# 3rd directory entry name DestList
+>>>>256 lestring16 DestList : Windows jump list
+#!:mime application/x-ole-storage
+!:mime application/x-ms-jumplist
+# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
+!:ext automaticDestinations-ms
+#
+# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache
+# Second directory entry name 256_
+>>>>128 lestring16 256_ : Windows thumbnail database 256
+#!:mime application/x-ole-storage
+!:mime application/x-ms-thumbnail
+# Thumbs.db
+!:ext db
+>>>>128 lestring16 96_ : Windows thumbnail database 96
+!:mime application/x-ms-thumbnail
+!:ext db
+# 3rd directory entry name Catalog_
+>>>>256 lestring16 Catalog : Windows thumbnail database
+!:mime application/x-ms-thumbnail
+!:ext db
+#
+# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
+# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
+# Second directory entry name Control000
+>>>>128 lestring16 Control000 : Microsoft old Systeminfo
+#!:mime application/x-ole-storage
+!:mime application/x-ms-info
+!:ext nfo
+#
+# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
+# Second directory entry name Thumbnail
+>>>>128 lestring16 Thumbnail : Corel PrintHouse image
+#!:mime application/x-ole-storage
+!:mime application/x-corel-cph
+!:ext cph
+# 3rd directory entry name Thumbnail
+>>>>256 lestring16 Thumbnail : Corel PrintHouse image
+!:mime application/x-corel-cph
+!:ext cph
+#
+# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
+# Note: "HWP Document File" signature found in FileHeader
+# Second directory entry name FileHeader hint for Thinkfree Office document
+>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File
+#!:mime application/haansofthwp
+!:mime application/x-hwp
+# https://example-files.online-convert.com/document/hwp/example.hwp
+!:ext hwp
+#
+# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
+# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
+>>>>128 lestring16 dd2 : StarOffice Gallery view
+#!:mime application/x-ole-storage
+!:mime application/x-star-sdv
+!:ext sdv
+# remaining null clsid
+>>>>128 default x : UNKNOWN
+!:mime application/x-ole-storage
+# look for known clsid GUID
+# - Visio documents
+# URL: http://fileformats.archiveteam.org/wiki/Visio
+# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
+>>88 ubequad 0xc000000000000046 : Microsoft
+>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template
+!:mime application/vnd.visio
+# VSD~Drawing VSS~Stencil VST~Template
+!:ext vsd/vss/vst
+>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template
+!:mime application/vnd.visio
+!:ext vsd/vss/vst
+#
+# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
+>>>80 ubequad 0x84100c0000000000 Windows Installer Package
+!:mime application/x-msi
+#!:mime application/x-ms-win-installer
+!:ext msi
+>>>80 ubequad 0x86100c0000000000 Windows Installer Patch
+# ??
+!:mime application/x-wine-extension-msp
+#!:mime application/x-ms-msp
+!:ext msp
+#
+# URL: http://fileformats.archiveteam.org/wiki/DOC
+>>>80 ubequad 0x0009020000000000 Word 6-95 document or template
+!:mime application/msword
+# for template MSWDW8TN
+!:apple MSWDWDBN
+!:ext doc/dot
+>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template
+!:mime application/msword
+!:apple MSWDWDBN
+# dot for template; no extension on Macintosh
+!:ext doc/dot/
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0x0213020000000000 Works 3-4 document or template
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+# ps for template https://filext.com/file-extension/PS bps for backup
+!:ext wps/ps/bps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
+>>>80 ubequad 0x0313020000000000 Works 3-4 database or template
+!:mime application/vnd.ms-works-db
+# https://www.macdisk.com/macsigen.php
+!:apple ????AWDB
+# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
+!:ext wdb/db/bdb
+#
+# URL: https://en.wikipedia.org/wiki/Microsoft_Excel
+>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php
+!:apple ????XLS5
+# worksheet/addin/template/no extension on Macintosh
+!:ext xls/xla/xlt/
+#
+>>>80 ubequad 0x2008020000000000 Excel 97-2003
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
+!:apple ????XLS9
+# 3nd directory entry name
+>>>>256 lestring16 _VBA_PROJECT_CUR addin
+!:ext xla/
+# 4th directory entry name
+>>>>384 lestring16 _VBA_PROJECT_CUR addin
+!:ext xla
+#!:ext xla/
+>>>>256 default x worksheet or template
+!:ext xls/xlt
+#!:ext xls/xlt/
+#
+# URL: http://fileformats.archiveteam.org/wiki/OLE2
+>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
+#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-msg
+!:ext msg
+# URL: https://wiki.fileformat.com/email/oft/
+>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-oft
+!:ext oft
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt
+#??
+# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
+>>88 ubequad 0xa29a00aa004a1a72 : Microsoft
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
+>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database
+!:mime application/vnd.ms-works-db
+!:apple ????AWDB
+!:ext wdb/bdb
+#??
+>>88 ubequad 0xa40700c04fb932ba : Microsoft
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#??
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
+>>88 ubequad 0x00c0000000000046 : Microsoft
+>>>80 ubequad 0x0112020000000000 Publisher
+!:mime application/vnd.ms-publisher
+!:ext pub
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+#??
+>>88 ubequad 0xa90300aa00510ea3 : Microsoft
+>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt/pot
+#??
+>>88 ubequad 0x86ea00aa00b929e8 : Microsoft
+>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template
+!:mime application/vnd.ms-powerpoint
+!:apple ????PPT3
+# /autostart/template
+!:ext ppt/pps/pot
+#
+# URL: https://en.wikipedia.org/wiki/Microsoft_Project
+#??
+>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft
+>>>80 ubequad 0x3a8fb774c8c8d111 Project
+!:mime application/vnd.ms-project
+!:ext mpp
+#
+# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
+#???
+>>88 ubequad 0x99ae04021c007002 : WordPerfect
+>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation
+!:mime application/x-corelpresentations
+#!:mime application/x-shw-viewer
+#!:mime image/x-presentations
+!:ext shw
+#
+# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
+>>>80 ubequad 0x60fe2e4099191b10 9 Graphic
+#!:mime application/x-wpg
+#!:mime image/x-wordperfect-graphics
+!:mime image/x-wpg
+# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
+!:apple ????WPC9
+!:ext wpg
+#
+# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
+>>88 ubequad 0x996104021c007002 : StarOffice
+>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template
+# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
+!:mime application/x-starwriter
+!:ext sdw/vor
+#
+>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template
+!:mime application/x-starcalc
+!:ext sdc/vor
+#
+>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template
+!:mime application/x-starimpress
+#!:mime application/x-stardraw
+# sda ??
+!:ext sdd/sda/vor
+#??
+>>88 ubequad 0x89cb008029e4b0b1 : StarOffice
+>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template
+!:mime application/x-starcalc
+!:ext sdc/vor
+#
+>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template
+!:mime application/vnd.stardivision.cal
+!:ext sdc/vor
+#
+>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template
+!:mime application/x-starimpress
+!:ext sdd/vor
+#??
+>>88 ubequad 0xb12a04021c007002 : StarOffice
+>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0
+!:mime application/x-starmath
+!:ext smf
+#??
+>>88 ubequad 0x8e2c00001b4cc711 : StarOffice
+>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0
+!:mime application/x-starchart
+!:ext sds
+#??
+>>88 ubequad 0xa45e00a0249d57b1 : StarOffice
+>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template
+!:mime application/x-starwriter
+!:ext sdw/vor
+#??
+>>88 ubequad 0x89ca008029e4b0b1 : StarOffice
+>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0
+!:mime application/x-starmath
+!:ext smf
+#
+>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0
+!:mime application/x-starchart
+!:ext sds
+#??
+>>88 ubequad 0xa53f00a0249d57b1 : StarOffice
+>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document
+!:mime application/x-starwriter-global
+!:ext sgl
+#??
+>>88 ubequad 0x89d0008029e4b0b1 : StarOffice
+>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0
+!:mime application/vnd.stardivision.math
+!:ext smf
+#
+>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template
+!:mime application/vnd.stardivision.draw
+!:ext sda/vor
+#
+>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template
+!:mime application/vnd.stardivision.impress
+# sda is used for what?
+!:ext sdd/vor/sda
+#
+>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0
+!:mime application/vnd.stardivision.chart
+!:ext sds
+# ??
+>>88 ubequad 0xaab4006097da561a : StarOffice
+>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template
+!:mime application/vnd.stardivision.writer
+!:ext sdw/vor
+#
+>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document
+!:mime application/vnd.stardivision.writer-global
+!:ext sgl
+#??
+# URL: http://fileformats.archiveteam.org/wiki/FlashPix
+>>88 ubequad 0x855300aa00a1f95b : Kodak
+>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image
+!:mime image/vnd.fpx
+!:apple ????FPix
+!:ext fpx
+# remaining non null clsid
+>>88 default x : UNKNOWN
+!:mime application/x-ole-storage
+>>>80 ubequad !0 \b, clsid 0x%16.16llx
+>>>88 ubequad x \b%16.16llx
+
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-msdos-ole2compounddocs.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0006.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-wordprocessors-ole2compounddocs.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0007.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-cdf.txt.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0008.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-soft-new.txt.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0009.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-soft.txt.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0010.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-ole2compounddocs.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190728/c1ac53d2/attachment-0011.obj>
More information about the File
mailing list