[File] [PATCH] Magdir/ole2compounddocs for Microsoft At Work fax Document *.AWD

Thu Apr 14 13:31:56 UTC 2022

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

some days ago i used a print copy utility on Windows. That can be
found on web site hardcopy.de. Per hot key the screen or parts of
it can be directed to printer or saved as file. On offered file
formats one is called "Microsoft Fax". When running file command
version 5.41 with -e cdf option on such examples i get an output like
:

hardcopy-ms-fax.awd: OLE 2 Compound Document, v3.62,
		     SecID 0x1, 2 FAT sectors,
		     Mini FAT start sector 0x95 :
		     UNKNOWN,
		     clsid 0x801cb0023de01a10b29400dd010f2bf9

Furthermore only generic mime type application/x-ole-storage is
shown with -i and -e cdf option. With option --extension only 3 byte
sequence ??? is shown.

When running file command with -e soft or no extra option for all
examples i get a output like:

hardcopy-ms-fax.awd: Composite Document File V2 Document,
		     Little Endian, Os: Windows, Version 10.0,
		     Revision Number: 1.0 (pages = docs),
		     Create Time/Date: Wed Apr 13 23:58:20 2022,
		     Last Saved Time/Date: Wed Apr 13 23:58:20 2022,
		     Number of Pages: 1,
		     Name of Creating Application: AtWork FAX,
		     Security: 0,
		     Author: AtWork FAX, Last Saved By: AtWork FAX

For comparison reason i run the file format identification utility
TrID ( See https://mark0.net/soft-trid-e.html). This identifies also
all examples with low priority as "Generic OLE2 / Multistream
Compound" by docfile.trid.xml. All examples are described as
"Microsoft At Work Fax document" with AWD file name extension by
awd-fax.trid.xml (See appended trid-v-awd.txt.gz).

For comparison reason i also run the file format identification
utility DROID ( See https://sourceforge.net/projects/droid/). This
identifies the AWD examples generic as "OLE2 Compound
Document Format" by fmt/111 Signature (See appended
droid-awd.csv.gz).

Luckily with information given by the other tools i also found a
page about AWD (At Work Document) on file formats archive team web
site. There it is written that is is based on Microsoft Compound File
format. That informations are expressed by comment lines inside
Magdir/ole2compounddocs like:
# URL:		http://fileformats.archiveteam.org/
#		wiki/AWD_(At_Work_Document)
# Reference:	http://mark0.net/download/triddefs_xml.7z
#		defs/a/awd-fax.trid.xml

The AWD examples are recognized as "OLE 2 Compound Document"
by starting bytes (\320\317\021\340\241\261\032\341) at the beginning
inside Magdir/ole2compounddocs. Obviously there exist no code
fragment to do sub class identification. So the examples are
described as "UNKNOWN". Furthermore the examples have a registered
Root storage object CLSID. That value is shown as
0x801cb0023de01a10b29400dd010f2bf9 or expressed in standard curly
braces expression by {02B01C80-E03D-101A-B294-00DD010F2BF9} .
That means that in branch handling non null CLSID GUID lines must be
added. The similar entry was Microsoft Project (*.mpp) with value
0x3a8fb774c8c8d111be1100c04fb6faf1. So i add before lines for my
inspected examples. That looks like:

>> 88 	ubequad		0xb29400dd010f2bf9	: Microsoft
>>> 80 	ubequad		0x801cb0023de01a10	At Work fax Document
!:mime	image/x-ms-awd
!:ext	awd

I found no official or often used mime type. So i display an user
defined one instead of generic application/x-ole-storage.

After applying the above mentioned modifications by patch
file-5.41-ole2compounddocs-awd.diff then all my inspected AWD
examples are now described with more details. This now looks with -e
cdf option like:

I hope my diff file can be applied in future version of file
utility.

With best wishes,
Jörg Jenderek
- --
Jörg Jenderek


-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCYlgiTAAKCRCv8rHJQhrU
1kuIAJ9+poNjMYA4h3KS9fFIs6xKhl/tcQCfcklVNpwUR2jVTwPyPQFn2j/nvms=
=e0j+
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: droid-awd.csv.gz
Type: application/x-gzip
Size: 276 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220414/703718e4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: trid-v-awd.txt.gz
Type: application/x-gzip
Size: 497 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220414/703718e4/attachment-0001.bin>
-------------- next part --------------

--- file-5.41/magic/Magdir/ole2compounddocs.old	2021-09-07 11:39:31.000000000 +0200
+++ file-5.41/magic/Magdir/ole2compounddocs	2022-04-14 02:35:56.577033400 +0200
@@ -418,4 +418,13 @@
 # /autostart/template
 !:ext	ppt/pps/pot
+# From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
+# Note:		called "Microsoft At Work Fax document" by TrID
+>>88 	ubequad		0xb29400dd010f2bf9	: Microsoft
+>>>80 	ubequad		0x801cb0023de01a10	At Work fax Document
+#!:mime	application/x-ole-storage
+!:mime	image/x-ms-awd
+!:ext	awd
 #
 # URL:	https://en.wikipedia.org/wiki/Microsoft_Project
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.41-ole2compounddocs-awd.diff.sig
Type: application/octet-stream
Size: 619 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220414/703718e4/attachment.obj>
