[File] [PATCH] Magdir/ole2compounddocs for Microsoft Access Wizard *.MDZ

Mon May 30 23:13:10 UTC 2022

Hello,

some days ago i stalled an old Microsoft Office 97. Just for interest
i checked Microsoft Access files from that version. When running file
command version 5.41 with -e cdf option on some examples i get an
output like:

Membership.mdz: OLE 2 Compound Document, v3.62,
		SecID 0x1, Mini FAT start sector 0x21 :
		UNKNOWN with names \005SummaryInformati
		\005DocumentSummaryI TemplateID
RECIPES.MDZ:    OLE 2 Compound Document, v3.62,
		SecID 0x1, Mini FAT start sector 0x18 :
		UNKNOWN with names \005SummaryInformati
		\005DocumentSummaryI TemplateID

Furthermore only generic mime type application/x-ole-storage is
shown with -i and -e cdf option. With option --extension only 3 byte
sequence ??? is shown.

When running file command with -e soft or no extra option for
inspected examples i get a output like:

Membership.mdz: Composite Document File V2 Document,
		Little Endian, Os: Windows,
		Version 3.51, Code page: 1252
RECIPES.MDZ:    Composite Document File V2 Document,
		Little Endian, Os: Windows,
		Version 3.51, Code page: 1252

For comparison reason i run the file format identification utility
TrID ( See https://mark0.net/soft-trid-e.html). This identifies
all examples with low priority as "Generic OLE2 / Multistream
Compound" by docfile.trid.xml. The examples are also described with
high rate as "Microsoft Access Wizard template" by mdz.trid.xml.
(See appended trid-v-mdz.txt.gz).

For comparison reason i also run the file format identification
utility DROID ( See https://sourceforge.net/projects/droid/). This
identifies the examples generic as "OLE2 Compound Document Format"
by fmt/111 signature (See appended droid-mdz.csv.gz).

Luckily with shown information i use the general Microsoft Access
page on Wikipedia site. That informations are expressed by comment
lines inside Magdir/ole2compounddocs like:
# URL:		https://en.wikipedia.org/wiki/Microsoft_Access
# Reference:	http://mark0.net/download/triddefs_xml.7z
#		defs/m/mdz.trid.xml
#		http://fileformats.archiveteam.org/
#		wiki/Microsoft_Compound_File

The examples are recognized as "OLE 2 Compound Document"
by starting bytes (\320\317\021\340\241\261\032\341) at the beginning
inside Magdir/ole2compounddocs. Obviously there exist no code
fragment to do sub class identification.  So the examples are
described as "UNKNOWN". Furthermore the examples have no registered
Root storage object CLSID or this value is nil. In that case file
command would display afterwords this information by a phrase like
", clsid 0xc0c7266eb98cd311a1c800c04f612452". That means that in
branch handling CLSID GUID 0 code must be added.

When reactivating and changing some debugging lines like:
 >128	lestring16	x \b, 2nd %.30s
 >256	lestring16	x \b, 3rd %.30s
 >384	lestring16	x \b, 4th %.16s
We see that fourth name in directory is like TemplateID, second
directory entry name is like \005SummaryInformation and third name is
like \005DocumentSummaryInformation. When looking in TrID definition
we see that fourth name string in UTF-16 form is used as
characteristic magic pattern.

The last similar entry was Microsoft old Systeminfo (*.nfo). So i add
afterwards lines for my inspected examples. That looks like:

 >>>>384 lestring16 TemplateID	: Microsoft Access wizard template
 !:mime	application/x-ms-mdz
 !:ext	mdz

Instead of generic application/x-ole-storage i choose an user
defined mime type. For Microsoft Access database you find types like
application/vnd.ms-access or application/msaccess, but no official
registered type and especially not for the MDZ wizard type.

After applying the above mentioned modifications by patch
file-5.41-ole2compounddocs-mdz.diff then all my inspected Access
examples are now described with more details. This now looks with
option -e cdf like:

Membership.mdz: OLE 2 Compound Document, v3.62,
		SecID 0x1, Mini FAT start sector 0x21 :
		Microsoft Access wizard template
RECIPES.MDZ:    OLE 2 Compound Document, v3.62,
		SecID 0x1, Mini FAT start sector 0x18 :
		Microsoft Access wizard template

I hope my diff file can be applied in future version of file
utility.

With best wishes,
Jörg Jenderek
--
Jörg Jenderek

-------------- next part --------------
A non-text attachment was scrubbed...
Name: droid-mdz.csv.gz
Type: application/x-gzip
Size: 296 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220531/4f2938ab/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: trid-v-mdz.txt.gz
Type: application/x-gzip
Size: 507 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220531/4f2938ab/attachment-0001.bin>
-------------- next part --------------

--- file-5.41/magic/Magdir/ole2compounddocs.old	2021-09-07 11:39:31.000000000 +0200
+++ file-5.41/magic/Magdir/ole2compounddocs	2022-05-30 22:13:30.050673000 +0200
@@ -198,10 +198,26 @@
 >>>>128 	lestring16	Control000		: Microsoft old Systeminfo
 #!:mime	application/x-ole-storage
 !:mime	application/x-ms-info
 !:ext	nfo
 #
+# From:		Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/Microsoft_Access
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
+#		http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
+# Note:		only version foo tested and called "Microsoft Access Wizard template" by TrID
+# Fourth directory entry name TemplateID
+>>>>384 	lestring16	TemplateID		: Microsoft Access wizard template
+# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
+#!:mime	application/x-ole-storage
+#!:mime	application/vnd.ms-office
+#!:mime	application/vnd.ms-access
+#!:mime	application/msaccess
+!:mime	application/x-ms-mdz
+# http://extension.nirsoft.net/mdz
+!:ext	mdz
+#
 # URL:	http://fileformats.archiveteam.org/wiki/Corel_Print_House
 # Second directory entry name Thumbnail
 >>>>128 	lestring16	Thumbnail		: Corel PrintHouse image
 #!:mime	application/x-ole-storage
 !:mime	application/x-corel-cph
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.41-ole2compounddocs-mdz.diff.sig
Type: application/octet-stream
Size: 765 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20220531/4f2938ab/attachment.obj>
