diff --git a/Wabbajack.Common/FileSignatures/Definitions/GKA_software_license.pdf b/Wabbajack.Common/FileSignatures/Definitions/GKA_software_license.pdf new file mode 100644 index 00000000..9d9245fc Binary files /dev/null and b/Wabbajack.Common/FileSignatures/Definitions/GKA_software_license.pdf differ diff --git a/Wabbajack.Common/FileSignatures/Definitions/bsasigs.txt b/Wabbajack.Common/FileSignatures/Definitions/bsasigs.txt new file mode 100644 index 00000000..31d9dcd9 --- /dev/null +++ b/Wabbajack.Common/FileSignatures/Definitions/bsasigs.txt @@ -0,0 +1,3 @@ +Morrowind BSA,00 01 00 00,TES3, null, null, 0, null +TES 4-5 and FO 3 BSA,42 53 41 00,BSA +FO4 BSA,42 54 44 58,BA2 \ No newline at end of file diff --git a/Wabbajack.Common/FileSignatures/Definitions/file_sigs_RAW.txt b/Wabbajack.Common/FileSignatures/Definitions/file_sigs_RAW.txt new file mode 100644 index 00000000..a738133b --- /dev/null +++ b/Wabbajack.Common/FileSignatures/Definitions/file_sigs_RAW.txt @@ -0,0 +1,547 @@ +JPEG2000 image files,00 00 00 0C 6A 50 20 20,JP2,Picture,0,(null) +3GPP multimedia files,00 00 00 14 66 74 79 70,3GP,Multimedia,0,(null) +MPEG-4 v1,00 00 00 14 66 74 79 70 69 73 6F 6D,MP4,Multimedia,0,(null) +3rd Generation Partnership Project 3GPP,00 00 00 14 66 74 79 70,3GG|3GP|3G2,Multimedia,0,(null) +Windows Disk Image,00 00 00 00 14 00 00 00,TBI,Windows,0,(null) +Bitcoin Core wallet.dat file,00 00 00 00 62 31 05 00 09 00 00 00 00 20 00 00 00 09 00 00 00 00 00 00,DAT,Finance,8,(null) +MPEG-4 video_1,00 00 00 18 66 74 79 70,3GP5|M4V|MP4,Multimedia,0,(null) +MPEG-4 video_2,00 00 00 1C 66 74 79 70,MP4,Multimedia,0,(null) +3GPP2 multimedia files,00 00 00 20 66 74 79 70,3GP,Multimedia,0,(null) +Apple audio and video,00 00 00 20 66 74 79 70 4D 34 41,M4A,Multimedia,0,(null) +3rd Generation Partnership Project 3GPP2,00 00 00 20 66 74 79 70,3GG|3GP|3G2,Multimedia,0,(null) +Windows icon|printer spool file,00 00 01 00,ICO|SPL,Windows,0,(null) +MPEG video file,00 00 01 B3,MPG,Multimedia,0,00 00 01 B7 +DVD video file,00 00 01 BA,MPG|VOB,Multimedia,0,00 00 01 B9 +Windows cursor,00 00 02 00,CUR,Windows,0,(null) +Compucon-Singer embroidery design file,00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00,XXX,Miscellaneous,0,(null) +QuattroPro spreadsheet,00 00 02 00,WB2,Spreadsheet,0,(null) +Wii images container,00 20 AF 30,TPL,System,0,(null) +Lotus 1-2-3 (v1),00 00 02 00 06 04 06 00,WK1,Spreadsheet,0,(null) +Lotus 1-2-3 (v3),00 00 1A 00 00 10 04 00,WK3,Spreadsheet,0,(null) +Lotus 1-2-3 (v4-v5),00 00 1A 00 02 10 04 00,WK4|WK5,Spreadsheet,0,(null) +Lotus 1-2-3 (v9),00 00 1A 00 05 10 04,123,Spreadsheet,0,(null) +Quark Express (Intel),00 00 49 49 58 50 52,QXD,Presentation,0,(null) +Quark Express (Motorola),00 00 4D 4D 58 50 52,QXD,Presentation,0,(null) +Windows Help file_1,00 00 FF FF FF FF,HLP,Windows,6,(null) +TrueType font file,00 01 00 00 00,TTF,Windows,0,(null) +Microsoft Money file,00 01 00 00 4D 53 49 53 41 4D 20 44 61 74 61 62 61 73 65,MNY,Finance,0,(null) +Microsoft Access 2007,00 01 00 00 53 74 61 6E 64 61 72 64 20 41 43 45 20 44 42,ACCDB,Database,0,(null) +Microsoft Access,00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42,MDB,Database,0,(null) +Palm Address Book Archive,00 01 42 41,ABA,Mobile,0,(null) +Palm DateBook Archive,00 01 42 44,DBA,Mobile,0,(null) +Netscape Navigator (v4) database,00 06 15 61 00 00 00 02 00 00 04 D2 00 00 10 00,DB,Network,0,(null) +FLIC animation,00 11,FLI,Miscellaneous,0,(null) +Netscape Communicator (v4) mail folder,00 1E 84 90 00 00 00 00,SNM,Email,0,(null) +PowerPoint presentation subheader_1,00 6E 1E F0,PPT,Presentation,512,(null) +Webex Advanced Recording Format,01 00 02 00,ARF,Video,0,(null) +Firebird and Interbase database files,01 00 39 30,FDB|GDB,Database,0,(null) +The Bat! Message Base Index,01 01 47 19 A4 00 00 00 00 00 00 00,TBI,Email,0,(null) +SQL Data Base,01 0F 00 00,MDF,Database,0,(null) +Novell LANalyzer capture file,01 10,TR1,Network,0,(null) +Silicon Graphics RGB Bitmap,01 DA 01 01 00 03,RGB,Picture,0,(null) +Micrografx vector graphic file,01 FF 02 04 03 02,DRW,Picture,0,(null) +Digital Speech Standard file,02 64 73 73,DSS,Multimedia,0,(null) +MapInfo Native Data Format,03,DAT,Navigation,0,(null) +dBASE III file,03,DB3,Database,0,(null) +Quicken price history,03 00 00 00,QPH,Finance,0,(null) +Approach index file,03 00 00 00 41 50 50 52,ADX,Database,0,(null) +dBASE IV file,04,DB4,Database,0,(null) +Adobe InDesign,06 06 ED F5 D8 1D 46 E5 BD 31 EF E7 FE 74 B7 1D,INDD,Media,0,(null) +Material Exchange Format,06 0E 2B 34 02 05 01 01 0D 01 02 01 01 02,MXF,Media,0,(null) +Generic drawing programs,07,DRW,Presentation,0,(null) +SkinCrafter skin,07 53 4B 46,SKF,Miscellaneous,0,(null) +DesignTools 2D Design file,07 64 74 32 64 64 74 64,DTD,Miscellaneous,0,(null) +dBASE IV or dBFast configuration file,08,DB,Database,0,(null) +Excel spreadsheet subheader_1,09 08 10 00 00 06 05 00,XLS,Spreadsheet,512,(null) +ZSOFT Paintbrush file_1,0A 02 01 01,PCX,Presentation,0,(null) +ZSOFT Paintbrush file_2,0A 03 01 01,PCX,Presentation,0,(null) +ZSOFT Paintbrush file_3,0A 05 01 01,PCX,Presentation,0,(null) +MultiBit Bitcoin wallet file,0A 16 6F 72 67 2E 62 69 74 63 6F 69 6E 2E 70 72,WALLET,e-money,0,(null) +Monochrome Picture TIFF bitmap,0C ED,MP,Picture,0,(null) +DeskMate Document,0D 44 4F 43,DOC,Word processing suite,0,(null) +Nero CD compilation,0E 4E 65 72 6F 49 53 4F,NRI,Miscellaneous,0,(null) +DeskMate Worksheet,0E 57 4B 53,WKS,Word processing suite,0,(null) +PowerPoint presentation subheader_2,0F 00 E8 03,PPT,Presentation,512,(null) +Sibelius Music - Score,0F 53 49 42 45 4C 49 55 53,SIB,Multimedia,0,(null) +Easy CD Creator 5 Layout file,10 00 00 00,CL5,Utility,0,(null) +Windows prefetch file,11 00 00 00 53 43 43 41,PF,Windows,0,(null) +Lotus Notes database template,1A 00 00,NTF,Spreadsheet,0,(null) +Lotus Notes database,1A 00 00 04 00 00,NSF,Spreadsheet,0,(null) +LH archive (old vers.-type 1),1A 02,ARC,Compressed archive,0,(null) +LH archive (old vers.-type 2),1A 03,ARC,Compressed archive,0,(null) +LH archive (old vers.-type 3),1A 04,ARC,Compressed archive,0,(null) +LH archive (old vers.-type 4),1A 08,ARC,Compressed archive,0,(null) +LH archive (old vers.-type 5),1A 09,ARC,Compressed archive,0,(null) +Compressed archive file,1A 0B,PAK,Compressed archive,0,(null) +WinPharoah capture file,1A 35 01 00,ETH,Network,0,(null) +WebM video file,1A 45 DF A3,WEBM,Multimedia,0,(null) +Matroska stream file_1,1A 45 DF A3,MKV,Multimedia,0,(null) +Matroska stream file_2,1A 45 DF A3 93 42 82 88,MKV,Multimedia,0,(null) +Runtime Software disk image,1A 52 54 53 20 43 4F 4D,DAT,Miscellaneous,0,(null) +WordStar Version 5.0-6.0 document,1D 7D,WS,Word processing suite,0,(null) +GZIP archive file,1F 8B 08,GZ,Compressed archive,0,(null) +VLC Player Skin file,1F 8B 08,VLT,Miscellaneous,0,(null) +Compressed tape archive_1,1F 9D 90,TAR.Z,Compressed archive,0,(null) +Compressed tape archive_2,1F A0,TAR.Z,Compressed archive,0,(null) +MapInfo Sea Chart,21,BSB,Navigation,0,(null) +AIN Compressed Archive,21 12,AIN,Compressed archive,0,(null) +Unix archiver (ar)-MS Program Library Common Object File Format (COFF),21 3C 61 72 63 68 3E 0A,LIB,Compressed archive,0,(null) +Microsoft Outlook Exchange Offline Storage Folder,21 42 44 4E,OST,Email,0,(null) +Cerius2 file,23 20,MSI,Miscellaneous,0,(null) +VMware 4 Virtual Disk description,23 20 44 69 73 6B 20 44,VMDK,Miscellaneous,0,(null) +MS Developer Studio project file,23 20 4D 69 63 72 6F 73,DSP,Programming,0,(null) +Adaptive Multi-Rate ACELP Codec (GSM),23 21 41 4D 52,AMR,Multimedia,0,(null) +Skype audio compression,23 21 53 49 4C 4B 0A,SIL,Multimedia,0,(null) +Radiance High Dynamic Range image file,23 3F 52 41 44 49 41 4E,HDR,Picture,0,(null) +VBScript Encoded script,23 40 7E 5E,VBE,Programming,0,(null) +Brother-Babylock-Bernina Home Embroidery,23 50 45 43 30 30 30 31,PEC,Miscellaneous,0,(null) +Brother-Babylock-Bernina Home Embroidery,23 50 45 53 30,PES,Miscellaneous,0,(null) +SPSS Data file,24 46 4C 32 40 28 23 29,SAV,Miscellaneous,0,(null) +Encapsulated PostScript file,25 21 50 53 2D 41 64 6F,EPS,Word processing suite,0,(null) +PDF file,25 50 44 46,PDF|FDF,Word processing suite,0,25 25 45 4F 46 +Fuzzy bitmap (FBM) file, 25 62 69 74 6D 61 70,FBM,Picture,0,(null) +BinHex 4 Compressed Archive,28 54 68 69 73 20 66 69,HQX,Compressed archive,0,(null) +Symantec Wise Installer log, 2A 2A 2A 20 20 49 6E 73,LOG,Miscellaneous,0,(null) +Compressed archive,2D 6C 68,LHA|LZH,Compressed archive,2,(null) +RealPlayer video file (V11+),2E 52 45 43,IVR,Multimedia,0,(null) +RealMedia streaming media,2E 52 4D 46,RM|RMVB,Multimedia,0,(null) +RealAudio file,2E 52 4D 46 00 00 00 12,RA,Multimedia,0,(null) +RealAudio streaming media,2E 72 61 FD 00,RA,Multimedia,0,(null) +NeXT-Sun Microsystems audio file,2E 73 6E 64,AU,Multimedia,0,(null) +Thunderbird-Mozilla Mail Summary File,2F 2F 20 3C 21 2D 2D 20 3C 6D 64 62 3A 6D 6F 72 6B 3A 7A,MSF,E-mail,0,(null) +MS security catalog file,30,CAT,Windows,0,(null) +Windows Event Viewer file,30 00 00 00 4C 66 4C 65,EVT,Windows,0,(null) +GEnealogical Data COMmunication (GEDCOM) file,30 20 48 45 41 44,GED,Miscellaneous,0,(null) +Windows Media Audio-Video File,30 26 B2 75 8E 66 CF 11,ASF|WMA|WMV,Multimedia,0,(null) +National Transfer Format Map,30 31 4F 52 44 4E 41 4E,NTF,Miscellaneous,0,(null) +MS Write file_1,31 BE,WRI,Word processing suite,0,(null) +MS Write file_2,32 BE,WRI,Word processing suite,0,(null) +Pfaff Home Embroidery,32 03 10 00 00 00 00 00 00 00 80 00 00 00 FF 00,PCS,Miscellaneous,0,(null) +7-Zip compressed file,37 7A BC AF 27 1C,7Z,Compressed archive,0,(null) +Photoshop image,38 42 50 53,PSD,Picture,0,(null) +Surfplan kite project file,3A 56 45 52 53 49 4F 4E,SLE,Miscellaneous,0,(null) +Advanced Stream Redirector,3C,ASX,Multimedia,0,(null) +BizTalk XML-Data Reduced Schema,3C,XDR,Miscellaneous,0,(null) +AOL HTML mail,3C 21 64 6F 63 74 79 70,DCI,Email,0,(null) +Windows Script Component,3C 3F,WSC,Windows,0,(null) +Windows Visual Stylesheet,3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D,MANIFEST,Programming,0,(null) +User Interface Language,3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 3F 3E,XML,Miscellaneous,0,(null) +MMC Snap-in Control file,3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 3F 3E 0D 0A 3C 4D 4D 43 5F 43 6F 6E 73 6F 6C 65 46 69 6C 65 20 43 6F 6E 73 6F 6C 65 56 65 72 73 69 6F 6E 3D 22,MSC,Windows,0,(null) +Picasa movie project file,3C 43 54 72 61 6E 73 54 69 6D 65 6C 69 6E 65 3E,MXF,Multimedia,0,(null) +Csound music,3C 43 73 6F 75 6E 64 53 79 6E 74 68 65 73 69 7A,CSD,Multimedia,0,(null) +Adobe FrameMaker,3C 4D 61 6B 65 72 46 69,FM|MIF,Presentation,0,(null) +GPS Exchange (v1.1),3C 67 70 78 20 76 65 72 73 69 6F 6E 3D 22 31 2E,GPX,Navigation,0,(null) +BASE85 file,3C 7E 36 3C 5C 25 5F 30 67 53 71 68 3B,B85,Word processing,0,7E 3E 0A +Quatro Pro for Windows 7.0,3E 00 03 00 FE FF 09 00 06,WB3,Spreadsheet,24,(null) +Windows Help file_2,3F 5F 03 00,GID|HLP,Windows,0,(null) +EndNote Library File,40 40 40 20 00 00 40 40 40 40,ENL,Miscellaneous,32,(null) +Generic AutoCAD drawing,41 43 31 30,DWG,Presentation,0,(null) +Steganos virtual secure drive,41 43 76,SLE,Miscellaneous,0,(null) +Harvard Graphics symbol graphic,41 4D 59 4F,SYW,Presentation,0,(null) +AOL config files,41 4F 4C,ABI|ABY|BAG|IDX|IND|PFC,Network,0,(null) +AOL and AIM buddy list,41 4F 4C 20 46 65 65 64,BAG,Network,0,(null) +AOL address book,41 4F 4C 44 42,ABY,Network,0,(null) +AOL user configuration,41 4F 4C 44 42,IDX,Network,0,(null) +AOL client preferences-settings file,41 4F 4C 49 44 58,IND,Network,0,(null) +AOL address book index,41 4F 4C 49 4E 44 45 58,ABI,Network,0,(null) +AOL personal file cabinet,41 4F 4C 56 4D 31 30 30,ORG|PFC,Network,0,(null) +AVG6 Integrity database,41 56 47 36 5F 49 6E 74,DAT,Database,0,(null) +RIFF Windows Audio,41 56 49 20 4C 49 53 54,AVI,Multimedia,8,(null) +FreeArc compressed file,41 72 43 01,ARC,Compressed archive,0,(null) +vCard,42 45 47 49 4E 3A 56 43,VCF,Miscellaneous,0,(null) +Speedtouch router firmware,42 4C 49 32 32 33,BIN|BLI|RBI,Network,0,(null) +Bitmap image,42 4D,BMP|DIB,Picture,0,(null) +Palmpilot resource file,42 4F 4F 4B 4D 4F 42 49,PRC,Mobile,0,(null) +Better Portable Graphics,42 50 47 FB,BPG,Multimedia,0,(null) +bzip2 compressed archive,42 5A 68,BZ2|TAR|BZ2|TBZ2|TB2,Compressed archive,0,(null) +Mac Disk image (BZ2 compressed),42 5A 68,DMG,Compressed archive,0,(null) +Puffer ASCII encrypted archive,42 65 67 69 6E 20 50 75 66 66 65 72,APUF,Encryption,0,(null) +Blink compressed archive,42 6C 69 6E 6B,BLI,Compressed archive,0,(null) +RagTime document,43 23 2B 44 A4 43 4D A5,RTD,Word processing suite,0,(null) +EA Interchange Format File (IFF)_3,43 41 54 20,IFF,Multimedia,0(null) +WordPerfect dictionary,43 42 46 49 4C 45,CBD,Word processing suite,0,(null) +ISO-9660 CD Disc Image,43 44 30 30 31,ISO,Compressed archive,0,(null) +RIFF CD audio,43 44 44 41 66 6D 74 20,CDA,Multimedia,8,(null) +Compressed ISO CD image,43 49 53 4F,CSO,Compressed archive,0,(null) +Windows 7 thumbnail,43 4D 4D 4D 15 00 00 00,DB,Windows,0,(null) +Corel Binary metafile,43 4D 58 31,CLB,Miscellaneous,0,(null) +COM+ Catalog,43 4F 4D 2B,CLB,Miscellaneous,0,(null) +VMware 3 Virtual Disk,43 4F 57 44,VMDK,Miscellaneous,0,(null) +Corel Photopaint file_1,43 50 54 37 46 49 4C 45,CPT,Presentation,0,(null) +Corel Photopaint file_2,43 50 54 46 49 4C 45,CPT,Presentation,0,(null) +Win9x registry hive,43 52 45 47,DAT,Windows,0,(null) +Crush compressed archive,43 52 55 53 48 20 76,CRU,Compressed archive,0,(null) +Shockwave Flash file,43 57 53,SWF,Multimedia,0,(null) +Calculux Indoor lighting project file,43 61 6C 63 75 6C 75 78 20 49 6E 64 6F 6F 72 20,CIN,Application,0,(null) +WhereIsIt Catalog,43 61 74 61 6C 6F 67 20,CTF,Miscellaneous,0,(null) +IE History file,43 6C 69 65 6E 74 20 55,DAT,Network,0,(null) +Google Chrome Extension,43 72 32 34,CRX,Programming,0,(null) +Creative Voice,43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46,VOC,Multimedia,0,(null) +PowerISO Direct-Access-Archive image,44 41 41 00 00 00 00 00,DAA,Compressed archive,0,(null) +DAX Compressed CD image,44 41 58 00,DAX,Miscellaneous,0,(null) +Palm Zire photo database,44 42 46 48,DB,Mobile,0,(null) +Amiga DiskMasher compressed archive,44 4D 53 21,DMS,Compressed archive,0,(null) +Amiga disk file,44 4F 53,ADF,Miscellaneous,0,(null) +DST Compression,44 53 54 62,DST,Compressed archive,0,(null) +DVR-Studio stream file,44 56 44,DVR,Multimedia,0,(null) +DVD info file,44 56 44,IFO,Multimedia,0,(null) +Elite Plus Commander game file,45 4C 49 54 45 20 43 6F,CDR,Miscellaneous,0,(null) +VideoVCD-VCDImager file,45 4E 54 52 59 56 43 44,VCD,Miscellaneous,0,(null) +Apple ISO 9660-HFS hybrid CD image,45 52 02 00 00,ISO,Compressed archive,0,(null) +EasyRecovery Saved State file,45 52 46 53 53 41 56 45,DAT,Miscellaneous,0,(null) +DSD Storage Facility audio file,44 53 44 20,DSF,Multimedia,0,(null) +MS Document Imaging file,45 50,MDI,Word processing suite,0,(null) +Expert Witness Compression Format,45 56 46 09 0D 0A FF 00,E01,Miscellaneous,0,(null) +EnCase Evidence File Format V2,45 56 46 32 0D 0A 81,Ex01,Miscellaneous,0,(null) +Windows Vista event log,45 6C 66 46 69 6C 65 00,EVTX,Windows,0,(null) +QuickBooks backup,45 86 00 00 06 00,QBB,Finance,0,(null) +MS Fax Cover Sheet,46 41 58 43 4F 56 45 52,CPE,Miscellaneous,0,(null) +Fiasco database definition file,46 44 42 48 00,FDB,Database,0,(null) +Flash video file,46 4C 56,FLV,Multimedia,0,(null) +IFF ANIM file,46 4F 52 4D,ANM,Multimedia,0,(null) +EA Interchange Format File (IFF)_1,46 4F 52 4D,IFF,Multimedia,0,(null) +Audio Interchange File,46 4F 52 4D 00,AIFF,Multimedia,0,(null) +DAKX Compressed Audio,46 4F 52 4D 00,DAX,Multimedia,0,(null) +Shockwave Flash player,46 57 53,SWF,Multimedia,0,(null) +Generic e-mail_2,46 72 6F 6D,EML,Email,0,(null) +GIF file,47 49 46 38,GIF,Picture,0,00 3B +GIMP pattern file,47 50 41 54,PAT,Picture,0,(null) +General Regularly-distributed Information (GRIdded) Binary,47 52 49 42,GRB,Miscellaneous,0,(null) +Show Partner graphics file,47 58 32,GX2,Picture,0,(null) +Genetec video archive,47 65 6E 65 74 65 63 20 4F 6D 6E 69 63 61 73 74,G64,Multimedia,0,(null) +SAS Transport dataset,48 45 41 44 45 52 20 52 45 43 4F 52 44 2A 2A 2A,XPT,Statistics,0,(null) +Harvard Graphics presentation file,48 48 47 42 31,SH3,Presentation,0,(null) +TIFF file_1,49 20 49,TIF|TIFF,Picture,0,(null) +MP3 audio file,49 44 33,MP3,Multimedia,0,(null) +Sprint Music Store audio,49 44 33 03 00 00 00,KOZ,Multimedia,0,(null) +Canon RAW file,49 49 1A 00 00 00 48 45,CRW,Picture,0,(null) +TIFF file_2,49 49 2A 00,TIF|TIFF,Picture,0,(null) +Windows 7 thumbnail_2,49 4D 4D 4D 15 00 00 00,DB,Windows,0,(null) +Install Shield compressed file,49 53 63 28,CAB|HDR,Compressed archive,0,(null) +MS Reader eBook,49 54 4F 4C 49 54 4C 53,LIT,Miscellaneous,0,(null) +MS Compiled HTML Help File,49 54 53 46,CHI|CHM,Windows,0,(null) +Inno Setup Uninstall Log,49 6E 6E 6F 20 53 65 74,DAT,Miscellaneous,0,(null) +Inter@ctive Pager Backup (BlackBerry file, 49 6E 74 65 72 40 63 74 69 76 65 20 50 61 67 65,IPD,Mobile,0,(null) +JARCS compressed archive,4A 41 52 43 53 00,JAR,Compressed archive,0,(null) +AOL ART file_1,4A 47 03 0E,JG,Picture,0,D0 CB 00 00 +AOL ART file_2,4A 47 04 0E,JG,Picture,0,CF C7 CB +VMware 4 Virtual Disk,4B 44 4D,VMDK,Miscellaneous,0,(null) +KGB archive,4B 47 42 5F 61 72 63 68,KGB,Compressed archive,0,(null) +Win9x printer spool file,4B 49 00 00,SHD,Windows,0,(null) +Windows shortcut file,4C 00 00 00 01 14 02 00,LNK,Windows,0,(null) +MS COFF relocatable object code,4C 01,OBJ,Windows,0,(null) +Tajima emboridery,4C 41 3A,DST,Miscellaneous,0,(null) +Windows help file_3,4C 4E 02 00,GID|HLP,Windows,0,(null) +EA Interchange Format File (IFF)_2,4C 49 53 54,IFF,Multimedia,0,(null) +DeluxePaint Animation,4C 50 46 20 00 01,ANM,Multimedia,0,(null) +Logical File Evidence Format,4C 56 46 09 0D 0A FF 00,E01,Miscellaneous,0,(null) +Merriam-Webster Pocket Dictionary,4D 2D 57 20 50 6F 63 6B,PDB,Miscellaneous,0,(null) +Mozilla archive,4D 41 52 31 00,MAR,Network,0,(null) +Microsoft-MSN MARC archive,4D 41 52 43,MAR,Compressed archive,0,(null) +MATLAB v5 workspace,4D 41 54 4C 41 42 20 35 2E 30 20 4D 41 54 2D 66 69 6C 65,MAT,Programming,0(null) +MAr compressed archive,4D 41 72 30 00,MAR,Compressed archive,0,(null) +TargetExpress target file,4D 43 57 20 54 65 63 68 6E 6F 67 6F 6C 69 65 73,MTE,Miscellaneous,0,(null) +Windows dump file,4D 44 4D 50 93 A7,DMP|HDMP,Windows,0,(null) +Milestones project management file,4D 49 4C 45 53,MLS,Miscellaneous,0,(null) +Skype localization data file,4D 4C 53 57,MLS,Network,0,(null) +TIFF file_3,4D 4D 00 2A,TIF|TIFF,Picture,0,(null) +TIFF file_4,4D 4D 00 2B,TIF|TIFF,Picture,0,(null) +Yamaha Synthetic music Mobile Application Format,4D 4D 4D 44 00 00,MMF,Multimedia,0,(null) +VMware BIOS state file,4D 52 56 4E,NVRAM,Miscellaneous,0,(null) +Microsoft cabinet file,4D 53 43 46,CAB,Windows,0,(null) +OneNote Package,4D 53 43 46,ONEPKG,Windows,0,(null) +Powerpoint Packaged Presentation,4D 53 43 46,PPZ,Presentation,0,(null) +MS Access Snapshot Viewer file,4D 53 43 46,SNP,Database,0,(null) +OLE-SPSS-Visual C++ library file,4D 53 46 54 02 00 01 00,TLB,Programming,0,(null) +Microsoft Windows Imaging Format,4D 53 57 49 4D,WIM,Picture,0,(null) +Sony Compressed Voice File,4D 53 5F 56 4F 49 43 45,CDR|DVF|MSV,Multimedia,0,(null) +MIDI sound file,4D 54 68 64,MID|MIDI,Multimedia,0,(null) +Yamaha Piano,4D 54 68 64,PCS,Multimedia,0,(null) +CD Stomper Pro label file,4D 56,DSN,Miscellaneous,0,(null) +Milestones project management file_1,4D 56 32 31 34,MLS,Miscellaneous,0,(null) +Milestones project management file_2,4D 56 32 43,MLS,Miscellaneous,0,(null) +Windows-DOS executable file,4D 5A,COM|DLL|DRV|EXE|PIF|QTS|QTX|SYS,Windows,0,(null) +MS audio compression manager driver,4D 5A,ACM,Multimedia,0,(null) +Library cache file,4D 5A,AX,Windows,0,(null) +Control panel application,4D 5A,CPL,Windows,0,(null) +Font file,4D 5A,FON,Windows,0,(null) +ActiveX-OLE Custom Control,4D 5A,OCX,Windows,0,(null) +OLE object library,4D 5A,OLB,Windows,0,(null) +Screen saver,4D 5A,SCR,Windows,0,(null) +VisualBASIC application,4D 5A,VBX,Programming,0,(null) +Windows virtual device drivers,4D 5A,VXD|386,Windows,0,(null) +Acrobat plug-in,4D 5A 90 00 03 00 00 00,API,Word processing suite,0,(null) +DirectShow filter,4D 5A 90 00 03 00 00 00,AX,Miscellaneous,0,(null) +Audition graphic filter,4D 5A 90 00 03 00 00 00,FLT,Miscellaneous,0,(null) +ZoneAlam data file,4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF,ZAP,Miscellaneous,0,(null) +MS C++ debugging symbols file,4D 69 63 72 6F 73 6F 66 74 20 43 2F 43 2B 2B 20,PDB,Programming,0,(null) +Visual Studio .NET file,4D 69 63 72 6F 73 6F 66 74 20 56 69 73 75 61 6C,SLN,Programming,0,(null) +Windows Media Player playlist,4D 69 63 72 6F 73 6F 66 74 20 57 69 6E 64 6F 77 73 20 4D 65 64 69 61 20 50 6C 61 79 65 72 20 2D 2D 20,WPL,Multimedia,84,(null) +VMapSource GPS Waypoint Database,4D 73 52 63 66,GDB,Navigation,0,(null) +TomTom traffic data,4E 41 56 54 52 41 46 46,DAT,Navigation,0,(null) +MS Windows journal,4E 42 2A 00,JNT|JTP,Windows,0,(null) +NES Sound file,4E 45 53 4D 1A 01,NSF,Multimedia,0,(null) +National Imagery Transmission Format file,4E 49 54 46 30,NTF,Picture,0,(null) +Agent newsreader character map,4E 61 6D 65 3A 20,COD,Miscellaneous,0,(null) +1Password 4 Cloud Keychain,4F 50 43 4C 44 41 54,attachment,Encryption,0,(null) +Psion Series 3 Database,4F 50 4C 44 61 74 61 62,DBF,Database,0,(null) +OpenType font,4F 54 54 4F 00,OTF,Word processing suite,0,(null) +Ogg Vorbis Codec compressed file,4F 67 67 53 00 02 00 00,OGA|OGG|OGV|OGX,Multimedia,0,(null) +Visio-DisplayWrite 4 text file,4F 7B,DW4,Presentation,0,(null) +Quicken QuickFinder Information File,50 00 00 00 20 00 00 00,IDX,Finance,0,(null) +Portable Graymap Graphic,50 35 0A,PGM,Picture,0,(null) +Quake archive file,50 41 43 4B,PAK,Compressed archive,0,(null) +Windows memory dump,50 41 47 45 44 55,DMP,Windows,0,(null) +PAX password protected bitmap,50 41 58,PAX,Picture,0,(null) +PestPatrol data-scan strings,50 45 53 54,DAT,Miscellaneous,0,(null) +PGP disk image,50 47 50 64 4D 41 49 4E,PGD,Compressed archive,0,(null) +ChromaGraph Graphics Card Bitmap,50 49 43 54 00 08,IMG,Picture,0,(null) +PKZIP archive_1,50 4B 03 04,ZIP,Compressed archive,0,50 4B ????????????????? 00 00 00 +Android package,50 4B 03 04,APK,Mobile,0,(null) +MacOS X Dashboard Widget,50 4B 03 04,ZIP,MacOS,0,(null) +MS Office Open XML Format Document,50 4B 03 04,DOCX|PPTX|XLSX,Word processing suite,0,(null) +Java archive_1,50 4B 03 04,JAR,Programming,0,(null) +Google Earth session file,50 4B 03 04,KMZ,Navigation,0,(null) +KWord document,50 4B 03 04,KWD,Word processing suite,0,(null) +OpenDocument template,50 4B 03 04,ODT|ODP|OTT,Word processing suite,0,(null) +Microsoft Open XML paper specification,50 4B 03 04,OXPS,Word processing suite,0,(null) +OpenOffice documents,50 4B 03 04,SXC|SXD|SXI|SXW,Word processing suite,0,(null) +StarOffice spreadsheet,50 4B 03 04,SXC,Spreadsheet,0,(null) +Windows Media compressed skin file,50 4B 03 04,WMZ,Windows,0,(null) +Mozilla Browser Archive,50 4B 03 04,XPI,Network,0,(null) +XML paper specification file,50 4B 03 04,XPS,Word processing suite,0,(null) +eXact Packager Models,50 4B 03 04,XPT,Miscellaneous,0,(null) +Open Publication Structure eBook,50 4B 03 04 0A 00 02 00,EPUB,Compressed archive,0,(null) +ZLock Pro encrypted ZIP,50 4B 03 04 14 00 01 00,ZIP,Compressed archive,0,(null) +MS Office 2007 documents,50 4B 03 04 14 00 06 00,DOCX|PPTX|XLSX,Word processing suite,0,(null) +Java archive_2,50 4B 03 04 14 00 08 00,JAR,Programming,0,(null) +PKZIP archive_2,50 4B 05 06,ZIP,Compressed archive,0,(null) +PKZIP archive_3,50 4B 07 08,ZIP,Compressed archive,0,(null) +PKLITE archive,50 4B 4C 49 54 45,ZIP,Compressed archive,30,(null) +PKSFX self-extracting archive,50 4B 53 70 58,ZIP,Compressed archive,526,(null) +Windows Program Manager group file,50 4D 43 43,GRP,Windows,0,(null) +Norton Disk Doctor undo file,50 4E 43 49 55 4E 44 4F,DAT,Miscellaneous,0,(null) +Microsoft Windows User State Migration Tool,50 4D 4F 43 43 4D 4F 43,PMOCCMOC,Windows,0,(null) +Dreamcast Sound Format,50 53 46 12,DSF,Multimedia,0,(null) +Puffer encrypted archive,50 55 46 58,PUF,Encryption,0,(null) +Quicken data,51 45 4C 20,QEL,Finance,92,(null) +Qcow Disk Image,51 46 49,QEMU,Miscellaneous,0,(null) +RIFF Qualcomm PureVoice,51 4C 43 4D 66 6D 74 20,QCP,Multimedia,8,(null) +Quicken data file,51 57 20 56 65 72 2E 20,ABD|QSD,Finance,0,(null) +Outlook-Exchange message subheader,52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 00,MSG,Email,512,(null) +Shareaza (P2P) thumbnail,52 41 5A 41 54 44 42 31,DAT,Network,0,(null) +R saved work space,52 44 58 32 0A,RDATA,Programming,0,(null) +WinNT Registry-Registry Undo files,52 45 47 45 44 49 54,REG|SUD,Windows,0,(null) +Antenna data file,52 45 56 4E 55 4D 3A 2C,AD,Miscellaneous,0,(null) +Windows animated cursor,52 49 46 46,ANI,Windows,0,(null) +Corel Presentation Exchange metadata,52 49 46 46,CMX,Presentation,0,(null) +CorelDraw document,52 49 46 46,CDR,Presentation,0,(null) +Video CD MPEG movie,52 49 46 46,DAT,Multimedia,0,(null) +Micrografx Designer graphic,52 49 46 46,DS4,Picture,0,(null) +4X Movie video,52 49 46 46,4XM,Multimedia,0,(null) +Resource Interchange File Format,52 49 46 46,AVI|CDA|QCP|RMI|WAV|WEBP,Multimedia,0,(null) +RIFF Windows MIDI,52 4D 49 44 64 61 74 61,RMI,Multimedia,8,(null) +WinNT Netmon capture file,52 54 53 53,CAP,Network,0,(null) +WinRAR compressed archive,52 61 72 21 1A 07 00,RAR,Compressed archive,0,(null) +Generic e-mail_1,52 65 74 75 72 6E 2D 50,EML,Email,0,(null) +Windows prefetch,53 43 43 41,PF,Windows,4,(null) +Underground Audio,53 43 48 6C,AST,Multimedia,0,(null) +Img Software Bitmap,53 43 4D 49,IMG,Picture,0,(null) +SMPTE DPX (big endian),53 44 50 58,SDPX,Picture,0,(null) +Harvard Graphics presentation,53 48 4F 57,SHW,Presentation,0,(null) +Sietronics CPI XRD document,53 49 45 54 52 4F 4E 49,CPI,Miscellaneous,0,(null) +Flexible Image Transport System (FITS) file,53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54,FITS,multimedia,0,(null) +StuffIt archive,53 49 54 21 00,SIT,Compressed archive,0,(null) +SmartDraw Drawing file,53 4D 41 52 54 44 52 57,SDR,Presentation,0,(null) +StorageCraft ShadownProtect backup file,53 50 46 49 00,SPF,Backup,0,(null) +MultiBit Bitcoin blockchain file,53 50 56 42,SPVB,e-money,0,(null) +SQLite database file,53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00,DB,Database,0,(null) +DB2 conversion file,53 51 4C 4F 43 4F 4E 56,CNV,Database,0,(null) +StuffIt compressed archive,53 74 75 66 66 49 74 20,SIT,Compressed archive,0,(null) +SuperCalc worksheet,53 75 70 65 72 43 61 6C,CAL,Spreadsheet,0,(null) +Wii-GameCube,54 48 50 00,THP,Multimedia,0,(null) +GNU Info Reader file,54 68 69 73 20 69 73 20,INFO,Programming,0,(null) +Unicode extensions,55 43 45 58,UCE,Windows,0,(null) +UFA compressed archive,55 46 41 C6 D2 C1,UFA,Compressed archive,0,(null) +UFO Capture map file,55 46 4F 4F 72 62 69 74,DAT,Miscellaneous,0,(null) +Visual C PreCompiled header,56 43 50 43 48 30,PCH,Programming,0,(null) +Visual Basic User-defined Control file,56 45 52 53 49 4F 4E 20,CTL,Programming,0,(null) +MapInfo Interchange Format file,56 65 72 73 69 6F 6E 20,MIF,Miscellaneous,0,(null) +SPSS template,57 04 00 00 53 50 53 53 20 74 65 6D 70 6C 61 74,SCT,Statistics,0,(null) +RIFF Windows Audio,57 41 56 45 66 6D 74 20,WAV,Multimedia,8,(null) +RIFF WebP,57 45 42 50,WEBP,Multimedia,8,(null) +Walkman MP3 file,57 4D 4D 50,DAT,Multimedia,0,(null) +WordStar for Windows file,57 53 32 30 30 30,WS2,Word processing suite,0,(null) +WinZip compressed archive,57 69 6E 5A 69 70,ZIP,Compressed archive,29152,(null) +Lotus WordPro file,57 6F 72 64 50 72 6F,LWP,Word processing suite,0,(null) +Exchange e-mail,58 2D,EML,Email,0,(null) +Packet sniffer files,58 43 50 00,CAP,Network,0,(null) +XPCOM libraries,58 50 43 4F 4D 0A 54 79,XPT,Programming,0,(null) +SMPTE DPX file (little endian),58 50 44 53,DPX,Picture,0,(null) +MS Publisher,58 54,BDR,Word processing suite,0,(null) +ZOO compressed archive,5A 4F 4F 20,ZOO,Compressed archive,0,(null) +Macromedia Shockwave Flash,5A 57 53,SWF,Multimedia,0,(null) +MS Exchange configuration file,5B 47 65 6E 65 72 61 6C,ECF,Email,0,(null) +Visual C++ Workbench Info File,5B 4D 53 56 43,VCW,Programming,0,(null) +Dial-up networking file,5B 50 68 6F 6E 65 5D,DUN,Network,0,(null) +Lotus AMI Pro document_1,5B 56 45 52 5D,SAM,Word processing suite,0,(null) +VocalTec VoIP media file,5B 56 4D 44 5D,VMD,Multimedia,0,(null) +Microsoft Code Page Translation file,5B 57 69 6E 64 6F 77 73,CPX,Windows,0,(null) +Flight Simulator Aircraft Configuration,5B 66 6C 74 73 69 6D 2E,CFG,Games,0,(null) +WinAmp Playlist,5B 70 6C 61 79 6C 69 73 74 5D,PLS,Audio,0,(null) +Lotus AMI Pro document_2,5B 76 65 72 5D,SAM,Word processing suite,0,(null) +Husqvarna Designer,5D FC C8 00,HUS,Miscellaneous,0,(null) +Jar archive,5F 27 A8 89,JAR,Miscellaneous,0,(null) +EnCase case file,5F 43 41 53 45 5F,CAS|CBK,Miscellaneous,0,(null) +Compressed archive file,60 EA,ARJ,Compressed archive,0,(null) +UUencoded BASE64 file,62 65 67 69 6E 2D 62 61 73 65 36 34,b64,Compressed archive,0,0A 3D 3D 3D 3D 0A +Apple Core Audio File,63 61 66 66,CAF,Multimedia,0,(null) +Macintosh encrypted Disk image (v1),63 64 73 61 65 6E 63 72,DMG,Compressed archive,0,(null) +Virtual PC HD image,63 6F 6E 65 63 74 69 78,VHD,Miscellaneous,0,(null) +Photoshop Custom Shape,63 75 73 68 00 00 00 02,CSH,Miscellaneous,0,(null) +Intel PROset-Wireless Profile,64 00 00 00,P10,Network,0,(null) +Torrent file,64 38 3A 61 6E 6E 6F 75 6E 63 65,TORRENT,Compressed archive,0,(null) +Dalvik (Android) executable file,64 65 78 0A,dex,Mobile,0,(null) +Audacity audio file,64 6E 73 2E,AU,Multimedia,0,(null) +MS Visual Studio workspace file,64 73 77 66 69 6C 65,DSW,Programming,0,(null) +Macintosh encrypted Disk image (v2),65 6E 63 72 63 64 73 61,DMG,Compressed archive,0,(null) +WinNT printer spool file,66 49 00 00,SHD,Windows,0,(null) +Free Lossless Audio Codec file,66 4C 61 43 00 00 00 22,FLAC,Multimedia,0,(null) +MPEG-4 video file_1,66 74 79 70 33 67 70 35,MP4,Multimedia,4,(null) +Apple Lossless Audio Codec file,66 74 79 70 4D 34 41 20,M4A,Multimedia,4,(null) +ISO Media-MPEG v4-iTunes AVC-LC,66 74 79 70 4D 34 56 20,FLV|M4V,Multimedia,4,(null) +MPEG-4 video file_2,66 74 79 70 4D 53 4E 56,MP4,Multimedia,4,(null) +ISO Base Media file (MPEG-4) v1,66 74 79 70 69 73 6F 6D,MP4,Multimedia,4,(null) +MPEG-4 video-QuickTime file,66 74 79 70 6D 70 34 32,M4V,Multimedia,4,(null) +QuickTime movie_7,66 74 79 70 71 74 20 20,MOV,Multimedia,4,(null) +Win2000-XP printer spool file,67 49 00 00,SHD,Windows,0,(null) +GIMP file,67 69 6d 70 20 78 63 66,XCF,Picture,0,(null) +Win Server 2003 printer spool file,68 49 00 00,SHD,Windows,0,(null) +Skype user data file,6C 33 33 6C,DBB,Network,0,(null) +QuickTime movie_1,6D 6F 6F 76,MOV,Multimedia,4,(null) +QuickTime movie_2,66 72 65 65,MOV,Multimedia,4,(null) +QuickTime movie_3,6D 64 61 74,MOV,Multimedia,4,(null) +QuickTime movie_4,77 69 64 65,MOV,Multimedia,4,(null) +QuickTime movie_5,70 6E 6F 74,MOV,Multimedia,4,(null) +QuickTime movie_6,73 6B 69 70,MOV,Multimedia,4,(null) +Internet Explorer v11 Tracking Protection List,6D 73 46 69 6C 74 65 72 4C 69 73 74,TPL,Programming,0,(null) +MultiBit Bitcoin wallet information,6D 75 6C 74 69 42 69 74 2E 69 6E 66 6F,INFO,E-money,0,(null) +WinNT registry file,72 65 67 66,DAT,Windows,0,(null) +Sonic Foundry Acid Music File,72 69 66 66,AC,Multimedia,0,(null) +RealMedia metafile,72 74 73 70 3A 2F 2F,RAM,Multimedia,0,(null) +Allegro Generic Packfile (compressed),73 6C 68 21,DAT,Miscellaneous,0,(null) +Allegro Generic Packfile (uncompressed),73 6C 68 2E,DAT,Miscellaneous,0,(null) +PalmOS SuperMemo,73 6D 5F,PDB,Mobile,0,(null) +STL (STereoLithography) file,73 6F 6C 69 64,STL,Multimedia,0,(null) +CALS raster bitmap,73 72 63 64 6F 63 69 64,CAL,Picture,0,(null) +PowerBASIC Debugger Symbols,73 7A 65 7A,PDB,Programming,0,(null) +PathWay Map file,74 42 4D 50 4B 6E 57 72,PRC,Mobile,60,(null) +TrueType font,74 72 75 65 00,TTF,Windows,0,(null) +Tape Archive,75 73 74 61 72,TAR,Compressed archive,257,(null) +OpenEXR bitmap image,76 2F 31 01,EXR,Picture,0,(null) +Qimage filter,76 32 30 30 33 2E 31 30,FLT,Miscellaneous,0,(null) +MacOS X image file,78 01 73 0D 62 62 60,DMG,MacOS,0,(null) +eXtensible ARchive file,78 61 72 21,XAR,Compressed archive,0,(null) +ZoomBrowser Image Index,7A 62 65 78,INFO,Miscellaneous,0,(null) +Windows application log,7B 0D 0A 6F 20,LGC|LGD,Windows,0,(null) +MS WinMobile personal note,7B 5C 70 77 69,PWI,Mobile,0,(null) +Rich Text Format,7B 5C 72 74 66 31,RTF,Word processing suite,0,5C 70 61 72 20 7D 7D +Corel Paint Shop Pro image,7E 42 4B 00,PSP,Presentation,0,(null) +Easy Street Draw diagram file,7E 45 53 44 77 F6 85 3E BF 6A D2 11 45 61 73 79 20 53 74 72 65 65 74 20 44 72 61 77,ESD,Presentation,0,(null) +Digital Watchdog DW-TP-500G audio,7E 74 2C 01 50 70 02 4D 52,IMG,Audio,0,(null) +Relocatable object code,80,OBJ,Windows,0,(null) +Dreamcast audio,80 00 00 20 03 12 04,ADX,Multimedia,0,(null) +Kodak Cineon image,80 2A 5F D7,CIN,Picture,0,(null) +Outlook Express address book (Win95),81 32 84 C1 85 05 D0 11,WAB,Email,0,(null) +WordPerfect text,81 CD AB,WPF,Word processing suite,0,(null) +PNG image,89 50 4E 47 0D 0A 1A 0A,PNG,Picture,0,49 45 4E 44 AE 42 60 82 +MS Answer Wizard,8A 01 09 00 00 00 E1 08,AW,Windows,0,(null) +Hamarsoft compressed archive,91 33 48 46,HAP,Compressed archive,0,(null) +PGP secret keyring_1,95 00,SKR,Miscellaneous,0,(null) +PGP secret keyring_2,95 01,SKR,Miscellaneous,0,(null) +JBOG2 image file,97 4A 42 32 0D 0A 1A 0A,JB2,Picture,0,03 33 00 01 00 00 00 00 +GPG public keyring,99,GPG,Miscellaneous,0,(null) +PGP public keyring,99 01,PKR,Miscellaneous,0,(null) +Outlook address file,9C CB CB 8D 13 75 D2 11,WAB,Email,0,(null) +Access Data FTK evidence,A9 0D 00 00 00 00 00 00,DAT,Miscellaneous,0,(null) +Quicken data,AC 9E BD 8F 00 00,QDF,Finance,0,(null) +PowerPoint presentation subheader_3,A0 46 1D F0,PPT,Presentation,512,(null) +BGBlitz position database file,AC ED 00 05 73 72 00 12,PDB,Miscellaneous,0,(null) +Win95 password file,B0 4D 46 43,PWL,Windows,0,(null) +PCX bitmap,B1 68 DE 3A,DCX,Presentation,0,(null) +Acronis True Image_1,B4 6E 68 44,TIB,Miscellaneous,0,(null) +Windows calendar,B5 A2 B0 B3 B3 B0 A5 B5,CAL,Windows,0,(null) +InstallShield Script,B8 C9 0C 00,INS,Windows,0,(null) +MS Write file_3,BE 00 00 00 AB,WRI,Word processing suite,0,(null) +Palm Desktop DateBook,BE BA FE CA 0F 50 61 6C 6D 53 47 20 44 61 74 61,DAT,Mobile,0,(null) +MS Agent Character file,C3 AB CD AB,ACS,Windows,0,(null) +Adobe encapsulated PostScript,C5 D0 D3 C6,EPS,Word processing suite,0,(null) +Jeppesen FliteLog file,C8 00 79 00,LBK,Miscellaneous,0,(null) +Java bytecode,CA FE BA BE,CLASS,Programming,0,(null) +Acronis True Image_2,CE 24 B9 A2 20 00 00 00,TIB,Multimedia,0,(null) +Java Cryptography Extension keystore,CE CE CE CE,JCEKS,Encryption,0,(null) +Perfect Office document,CF 11 E0 A1 B1 1A E1 00,DOC,Word processing suite,0,(null) +Outlook Express e-mail folder,CF AD 12 FE,DBX,Email,0,(null) +Microsoft Office document,D0 CF 11 E0 A1 B1 1A E1,DOC|DOT|PPS|PPT|XLA|XLS|WIZ,Word processing suite,0,(null) +CaseWare Working Papers,D0 CF 11 E0 A1 B1 1A E1,AC_,Miscellaneous,0,(null) +Access project file,D0 CF 11 E0 A1 B1 1A E1,ADP,Database,0,(null) +Lotus-IBM Approach 97 file,D0 CF 11 E0 A1 B1 1A E1,APR,Database,0,(null) +MSWorks database file,D0 CF 11 E0 A1 B1 1A E1,DB,Database,0,(null) +Microsoft Common Console Document,D0 CF 11 E0 A1 B1 1A E1,MSC,Windows,0,(null) +Microsoft Installer package,D0 CF 11 E0 A1 B1 1A E1,MSI,Windows,0,(null) +Microsoft Installer Patch,D0 CF 11 E0 A1 B1 1A E1,MSP,Windows,0,(null) +Minitab data file,D0 CF 11 E0 A1 B1 1A E1,MTW,Statistics,0,(null) +ArcMap GIS project file,D0 CF 11 E0 A1 B1 1A E1,MXD,Miscellaneous,0,(null) +Developer Studio File Options file,D0 CF 11 E0 A1 B1 1A E1,OPT,Programming,0,(null) +MS Publisher file,D0 CF 11 E0 A1 B1 1A E1,PUB,Word processing suite,0,(null) +Revit Project file,D0 CF 11 E0 A1 B1 1A E1,RVT,Miscellaneous,0,(null) +Visual Studio Solution User Options file,D0 CF 11 E0 A1 B1 1A E1,SOU,Programming,0,(null) +SPSS output file,D0 CF 11 E0 A1 B1 1A E1,SPO,Miscellaneous,0,(null) +Visio file,D0 CF 11 E0 A1 B1 1A E1,VSD,Miscellaneous,0,(null) +MSWorks text document,D0 CF 11 E0 A1 B1 1A E1,WPS,Word processing suite,0,(null) +WinPharoah filter file,D2 0A 00 00,FTR,Network,0,(null) +AOL history|typed URL files,D4 2A,ARL|AUT,Network,0,(null) +Windows graphics metafile,D7 CD C6 9A,WMF,Windows,0,(null) +Word 2.0 file,DB A5 2D 00,DOC,Word processing,0,(null) +Corel color palette,DC DC,CPL,Presentation,0,(null) +eFax file,DC FE,EFX,Miscellaneous,0,(null) +Amiga icon,E3 10 00 01 00 00 00 00,INFO,Miscellaneous,0,(null) +Win98 password file,E3 82 85 96,PWL,Windows,0,(null) +MS OneNote note,E4 52 5C 7B 8C D8 A7 4D,ONE,Miscellaneous,0,(null) +Windows executable file_1,E8,COM|SYS,Windows,0,(null) +Windows executable file_2,E9,COM|SYS,Windows,0,(null) +Windows executable file_3,EB,COM|SYS,Windows,0,(null) +GEM Raster file,EB 3C 90 2A,IMG,Picture,0,(null) +Word document subheader,EC A5 C1 00,DOC,Word processing suite,512,(null) +RedHat Package Manager,ED AB EE DB,RPM,Compressed archive,0,(null) +Windows Script Component (UTF-8)_1,EF BB BF 3C,WSF,Windows,0,(null) +Windows Script Component (UTF-8)_2,EF BB BF 3C 3F,WSC,Windows,0,(null) +Bitcoin-Qt blockchain block file,F9 BE B4 D9,DAT,E-money,0,(null) +XZ archive,FD 37 7A 58 5A 00,XZ,Compressed archive,0,(null) +MS Publisher subheader,FD 37 7A 58 5A 00,PUB,Word processing,512,(null) +Thumbs.db subheader,FD FF FF FF,DB,Windows,512,(null) +MS Publisher file subheader,FD FF FF FF 02,PUB,Word processing suite,512,(null) +Visual Studio Solution subheader,FD FF FF FF 04,SUO,Programming,512,(null) +PowerPoint presentation subheader_4,FD FF FF FF 0E 00 00 00,PPT,Presentation,512,(null) +Excel spreadsheet subheader_2,FD FF FF FF 10,XLS,Spreadsheet,512,(null) +PowerPoint presentation subheader_5,FD FF FF FF 1C 00 00 00,PPT,Presentation,512,(null) +Excel spreadsheet subheader_3,FD FF FF FF 1F,XLS,Spreadsheet,512,(null) +Developer Studio subheader,FD FF FF FF 20,OPT,Programming,512,(null) +Excel spreadsheet subheader_4,FD FF FF FF 22,XLS,Spreadsheet,512,(null) +Excel spreadsheet subheader_5,FD FF FF FF 23,XLS,Spreadsheet,512,(null) +Excel spreadsheet subheader_6,FD FF FF FF 28,XLS,Spreadsheet,512,(null) +Excel spreadsheet subheader_7,FD FF FF FF 29,XLS,Spreadsheet,512,(null) +PowerPoint presentation subheader_6,FD FF FF FF 43 00 00 00,PPT,Presentation,512,(null) +Symantex Ghost image file,FE EF,GHO|GHS,Compressed archive,0,(null) +Windows executable,FF,SYS,Windows,0,(null) +Works for Windows spreadsheet,FF 00 02 00 04 04 05 54,WKS,Spreadsheet,0,(null) +QuickReport Report,FF 0A 00,QRP,Financial,0,(null) +Windows international code page,FF 46 4F 4E 54,CPI,Windows,0,(null) +Keyboard driver file,FF 4B 45 59 42 20 20 20,SYS,Windows,0,(null) +WordPerfect text and graphics,FF 57 50 43,WP|WPD|WPG|WPP|WP5|WP6,Word processing suite,0,(null) +JPEG-EXIF-SPIFF images,FF D8 FF,JFIF|JPE|JPEG|JPG,Picture,0,FF D9 +MPEG-4 AAC audio,FF F1,AAC,Audio,0,(null) +MPEG-2 AAC audio,FF F9,AAC,Audio,0,(null) +Windows Registry file,FF FE,REG,Windows,0,(null) +MSinfo file,FF FE 23 00 6C 00 69 00,MOF,Windows,0,(null) +DOS system driver,FF FF FF FF,SYS,Windows,0,(null) diff --git a/Wabbajack.Common/FileSignatures/SignatureChecker.cs b/Wabbajack.Common/FileSignatures/SignatureChecker.cs new file mode 100644 index 00000000..652df57c --- /dev/null +++ b/Wabbajack.Common/FileSignatures/SignatureChecker.cs @@ -0,0 +1,45 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; + +namespace Wabbajack.Common.FileSignatures +{ + public class SignatureChecker + { + private HashSet _types; + private (Definitions.FileType, byte[])[] _signatures; + + public SignatureChecker(params Definitions.FileType[] types) + { + _types = new HashSet(types); + _signatures = Definitions.Signatures.Where(row => _types.Contains(row.Item1)).ToArray(); + } + + public async Task MatchesAsync(AbsolutePath path) + { + await using var fs = await path.OpenShared(); + foreach (var signature in _signatures) + { + var buffer = new byte[signature.Item2.Length]; + fs.Position = 0; + await fs.ReadAsync(buffer); + if (AreEqual(buffer, signature.Item2)) + return signature.Item1; + } + return null; + } + + private static bool AreEqual(byte[] a, byte[] b) + { + if (a.Length != b.Length) return false; + for (var i = 0; i < a.Length; i++) + { + if (a[i] != b[i]) return false; + } + + return true; + } + + } +} diff --git a/Wabbajack.Common/FileSignatures/Signatures.cs b/Wabbajack.Common/FileSignatures/Signatures.cs new file mode 100644 index 00000000..dcd0482d --- /dev/null +++ b/Wabbajack.Common/FileSignatures/Signatures.cs @@ -0,0 +1,2358 @@ + +namespace Wabbajack.Common.FileSignatures { + public static class Definitions { + public enum FileType { _123, + _386, + _3G2, + _3GG, + _3GP, + _3GP5, + _4XM, + _7Z, + AAC, + ABA, + ABD, + ABI, + ABY, + AC, + AC_, + ACCDB, + ACM, + ACS, + AD, + ADF, + ADP, + ADX, + AIFF, + AIN, + AMR, + ANI, + ANM, + API, + APK, + APR, + APUF, + ARC, + ARF, + ARJ, + ARL, + ASF, + AST, + ASX, + attachment, + AU, + AUT, + AVI, + AW, + AX, + b64, + B85, + BA2, + BAG, + BDR, + BIN, + BLI, + BMP, + BPG, + BSA, + BSB, + BZ2, + CAB, + CAF, + CAL, + CAP, + CAS, + CAT, + CBD, + CBK, + CDA, + CDR, + CFG, + CHI, + CHM, + CIN, + CL5, + CLASS, + CLB, + CMX, + CNV, + COD, + COM, + CPE, + CPI, + CPL, + CPT, + CPX, + CRU, + CRW, + CRX, + CSD, + CSH, + CSO, + CTF, + CTL, + CUR, + DAA, + DAT, + DAX, + DB, + DB3, + DB4, + DBA, + DBB, + DBF, + DBX, + DCI, + DCX, + dex, + DIB, + DLL, + DMG, + DMP, + DMS, + DOC, + DOCX, + DOT, + DPX, + DRV, + DRW, + DS4, + DSF, + DSN, + DSP, + DSS, + DST, + DSW, + DTD, + DUN, + DVF, + DVR, + DW4, + DWG, + E01, + ECF, + EFX, + EML, + ENL, + EPS, + EPUB, + ESD, + ETH, + EVT, + EVTX, + Ex01, + EXE, + EXR, + FBM, + FDB, + FDF, + FITS, + FLAC, + FLI, + FLT, + FLV, + FM, + FON, + FTR, + G64, + GDB, + GED, + GHO, + GHS, + GID, + GIF, + GPG, + GPX, + GRB, + GRP, + GX2, + GZ, + HAP, + HDMP, + HDR, + HLP, + HQX, + HUS, + ICO, + IDX, + IFF, + IFO, + IMG, + IND, + INDD, + INFO, + INS, + IPD, + ISO, + IVR, + JAR, + JB2, + JCEKS, + JFIF, + JG, + JNT, + JP2, + JPE, + JPEG, + JPG, + JTP, + KGB, + KMZ, + KOZ, + KWD, + LBK, + LGC, + LGD, + LHA, + LIB, + LIT, + LNK, + LOG, + LWP, + LZH, + M4A, + M4V, + MANIFEST, + MAR, + MAT, + MDB, + MDF, + MDI, + MID, + MIDI, + MIF, + MKV, + MLS, + MMF, + MNY, + MOF, + MOV, + MP, + MP3, + MP4, + MPG, + MSC, + MSF, + MSG, + MSI, + MSP, + MSV, + MTE, + MTW, + MXD, + MXF, + NRI, + NSF, + NTF, + NVRAM, + OBJ, + OCX, + ODP, + ODT, + OGA, + OGG, + OGV, + OGX, + OLB, + ONE, + ONEPKG, + OPT, + ORG, + OST, + OTF, + OTT, + OXPS, + P10, + PAK, + PAT, + PAX, + PCH, + PCS, + PCX, + PDB, + PDF, + PEC, + PES, + PF, + PFC, + PGD, + PGM, + PIF, + PKR, + PLS, + PMOCCMOC, + PNG, + PPS, + PPT, + PPTX, + PPZ, + PRC, + PSD, + PSP, + PUB, + PUF, + PWI, + PWL, + QBB, + QCP, + QDF, + QEL, + QEMU, + QPH, + QRP, + QSD, + QTS, + QTX, + QXD, + RA, + RAM, + RAR, + RBI, + RDATA, + REG, + RGB, + RM, + RMI, + RMVB, + RPM, + RTD, + RTF, + RVT, + SAM, + SAV, + SCR, + SCT, + SDPX, + SDR, + SH3, + SHD, + SHW, + SIB, + SIL, + SIT, + SKF, + SKR, + SLE, + SLN, + SNM, + SNP, + SOU, + SPF, + SPL, + SPO, + SPVB, + STL, + SUD, + SUO, + SWF, + SXC, + SXD, + SXI, + SXW, + SYS, + SYW, + TAR, + TARZ, + TB2, + TBI, + TBZ2, + TES3, + THP, + TIB, + TIF, + TIFF, + TLB, + TORRENT, + TPL, + TR1, + TTF, + UCE, + UFA, + VBE, + VBX, + VCD, + VCF, + VCW, + VHD, + VLT, + VMD, + VMDK, + VOB, + VOC, + VSD, + VXD, + WAB, + WALLET, + WAV, + WB2, + WB3, + WEBM, + WEBP, + WIM, + WIZ, + WK1, + WK3, + WK4, + WK5, + WKS, + WMA, + WMF, + WMV, + WMZ, + WP, + WP5, + WP6, + WPD, + WPF, + WPG, + WPL, + WPP, + WPS, + WRI, + WS, + WS2, + WSC, + WSF, + XAR, + XCF, + XDR, + XLA, + XLS, + XLSX, + XML, + XPI, + XPS, + XPT, + XXX, + XZ, + ZAP, + ZIP, + ZOO, + } + + public static (FileType, byte[])[] Signatures = { + // Morrowind BSA + (FileType.TES3, new byte[] {0x00, 0x01, 0x00, 0x00}), + + // TES 4-5 and FO 3 BSA + (FileType.BSA, new byte[] {0x42, 0x53, 0x41, 0x00}), + + // FO4 BSA + (FileType.BA2, new byte[] {0x42, 0x54, 0x44, 0x58}), + + // JPEG2000 image files + (FileType.JP2, new byte[] {0x00, 0x00, 0x00, 0x0C, 0x6A, 0x50, 0x20, 0x20}), + + // 3GPP multimedia files + (FileType._3GP, new byte[] {0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70}), + + // MPEG-4 v1 + (FileType.MP4, new byte[] {0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6F, 0x6D}), + + // 3rd Generation Partnership Project 3GPP + (FileType._3GG, new byte[] {0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70}), + + // 3rd Generation Partnership Project 3GPP + (FileType._3GP, new byte[] {0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70}), + + // 3rd Generation Partnership Project 3GPP + (FileType._3G2, new byte[] {0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70}), + + // Windows Disk Image + (FileType.TBI, new byte[] {0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00}), + + // Bitcoin Core wallet.dat file + (FileType.DAT, new byte[] {0x00, 0x00, 0x00, 0x00, 0x62, 0x31, 0x05, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}), + + // MPEG-4 video_1 + (FileType._3GP5, new byte[] {0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70}), + + // MPEG-4 video_1 + (FileType.M4V, new byte[] {0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70}), + + // MPEG-4 video_1 + (FileType.MP4, new byte[] {0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70}), + + // MPEG-4 video_2 + (FileType.MP4, new byte[] {0x00, 0x00, 0x00, 0x1C, 0x66, 0x74, 0x79, 0x70}), + + // 3GPP2 multimedia files + (FileType._3GP, new byte[] {0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70}), + + // Apple audio and video + (FileType.M4A, new byte[] {0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x41}), + + // 3rd Generation Partnership Project 3GPP2 + (FileType._3GG, new byte[] {0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70}), + + // 3rd Generation Partnership Project 3GPP2 + (FileType._3GP, new byte[] {0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70}), + + // 3rd Generation Partnership Project 3GPP2 + (FileType._3G2, new byte[] {0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70}), + + // Windows icon|printer spool file + (FileType.ICO, new byte[] {0x00, 0x00, 0x01, 0x00}), + + // Windows icon|printer spool file + (FileType.SPL, new byte[] {0x00, 0x00, 0x01, 0x00}), + + // MPEG video file + (FileType.MPG, new byte[] {0x00, 0x00, 0x01, 0xB3}), + + // DVD video file + (FileType.MPG, new byte[] {0x00, 0x00, 0x01, 0xBA}), + + // DVD video file + (FileType.VOB, new byte[] {0x00, 0x00, 0x01, 0xBA}), + + // Windows cursor + (FileType.CUR, new byte[] {0x00, 0x00, 0x02, 0x00}), + + // Compucon-Singer embroidery design file + (FileType.XXX, new byte[] {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}), + + // QuattroPro spreadsheet + (FileType.WB2, new byte[] {0x00, 0x00, 0x02, 0x00}), + + // Wii images container + (FileType.TPL, new byte[] {0x00, 0x20, 0xAF, 0x30}), + + // Lotus 1-2-3 (v1) + (FileType.WK1, new byte[] {0x00, 0x00, 0x02, 0x00, 0x06, 0x04, 0x06, 0x00}), + + // Lotus 1-2-3 (v3) + (FileType.WK3, new byte[] {0x00, 0x00, 0x1A, 0x00, 0x00, 0x10, 0x04, 0x00}), + + // Lotus 1-2-3 (v4-v5) + (FileType.WK4, new byte[] {0x00, 0x00, 0x1A, 0x00, 0x02, 0x10, 0x04, 0x00}), + + // Lotus 1-2-3 (v4-v5) + (FileType.WK5, new byte[] {0x00, 0x00, 0x1A, 0x00, 0x02, 0x10, 0x04, 0x00}), + + // Lotus 1-2-3 (v9) + (FileType._123, new byte[] {0x00, 0x00, 0x1A, 0x00, 0x05, 0x10, 0x04}), + + // Quark Express (Intel) + (FileType.QXD, new byte[] {0x00, 0x00, 0x49, 0x49, 0x58, 0x50, 0x52}), + + // Quark Express (Motorola) + (FileType.QXD, new byte[] {0x00, 0x00, 0x4D, 0x4D, 0x58, 0x50, 0x52}), + + // Windows Help file_1 + (FileType.HLP, new byte[] {0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF}), + + // TrueType font file + (FileType.TTF, new byte[] {0x00, 0x01, 0x00, 0x00, 0x00}), + + // Microsoft Money file + (FileType.MNY, new byte[] {0x00, 0x01, 0x00, 0x00, 0x4D, 0x53, 0x49, 0x53, 0x41, 0x4D, 0x20, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65}), + + // Microsoft Access 2007 + (FileType.ACCDB, new byte[] {0x00, 0x01, 0x00, 0x00, 0x53, 0x74, 0x61, 0x6E, 0x64, 0x61, 0x72, 0x64, 0x20, 0x41, 0x43, 0x45, 0x20, 0x44, 0x42}), + + // Microsoft Access + (FileType.MDB, new byte[] {0x00, 0x01, 0x00, 0x00, 0x53, 0x74, 0x61, 0x6E, 0x64, 0x61, 0x72, 0x64, 0x20, 0x4A, 0x65, 0x74, 0x20, 0x44, 0x42}), + + // Palm Address Book Archive + (FileType.ABA, new byte[] {0x00, 0x01, 0x42, 0x41}), + + // Palm DateBook Archive + (FileType.DBA, new byte[] {0x00, 0x01, 0x42, 0x44}), + + // Netscape Navigator (v4) database + (FileType.DB, new byte[] {0x00, 0x06, 0x15, 0x61, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x04, 0xD2, 0x00, 0x00, 0x10, 0x00}), + + // FLIC animation + (FileType.FLI, new byte[] {0x00, 0x11}), + + // Netscape Communicator (v4) mail folder + (FileType.SNM, new byte[] {0x00, 0x1E, 0x84, 0x90, 0x00, 0x00, 0x00, 0x00}), + + // PowerPoint presentation subheader_1 + (FileType.PPT, new byte[] {0x00, 0x6E, 0x1E, 0xF0}), + + // Webex Advanced Recording Format + (FileType.ARF, new byte[] {0x01, 0x00, 0x02, 0x00}), + + // Firebird and Interbase database files + (FileType.FDB, new byte[] {0x01, 0x00, 0x39, 0x30}), + + // Firebird and Interbase database files + (FileType.GDB, new byte[] {0x01, 0x00, 0x39, 0x30}), + + // The Bat! Message Base Index + (FileType.TBI, new byte[] {0x01, 0x01, 0x47, 0x19, 0xA4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}), + + // SQL Data Base + (FileType.MDF, new byte[] {0x01, 0x0F, 0x00, 0x00}), + + // Novell LANalyzer capture file + (FileType.TR1, new byte[] {0x01, 0x10}), + + // Silicon Graphics RGB Bitmap + (FileType.RGB, new byte[] {0x01, 0xDA, 0x01, 0x01, 0x00, 0x03}), + + // Micrografx vector graphic file + (FileType.DRW, new byte[] {0x01, 0xFF, 0x02, 0x04, 0x03, 0x02}), + + // Digital Speech Standard file + (FileType.DSS, new byte[] {0x02, 0x64, 0x73, 0x73}), + + // MapInfo Native Data Format + (FileType.DAT, new byte[] {0x03}), + + // dBASE III file + (FileType.DB3, new byte[] {0x03}), + + // Quicken price history + (FileType.QPH, new byte[] {0x03, 0x00, 0x00, 0x00}), + + // Approach index file + (FileType.ADX, new byte[] {0x03, 0x00, 0x00, 0x00, 0x41, 0x50, 0x50, 0x52}), + + // dBASE IV file + (FileType.DB4, new byte[] {0x04}), + + // Adobe InDesign + (FileType.INDD, new byte[] {0x06, 0x06, 0xED, 0xF5, 0xD8, 0x1D, 0x46, 0xE5, 0xBD, 0x31, 0xEF, 0xE7, 0xFE, 0x74, 0xB7, 0x1D}), + + // Material Exchange Format + (FileType.MXF, new byte[] {0x06, 0x0E, 0x2B, 0x34, 0x02, 0x05, 0x01, 0x01, 0x0D, 0x01, 0x02, 0x01, 0x01, 0x02}), + + // Generic drawing programs + (FileType.DRW, new byte[] {0x07}), + + // SkinCrafter skin + (FileType.SKF, new byte[] {0x07, 0x53, 0x4B, 0x46}), + + // DesignTools 2D Design file + (FileType.DTD, new byte[] {0x07, 0x64, 0x74, 0x32, 0x64, 0x64, 0x74, 0x64}), + + // dBASE IV or dBFast configuration file + (FileType.DB, new byte[] {0x08}), + + // Excel spreadsheet subheader_1 + (FileType.XLS, new byte[] {0x09, 0x08, 0x10, 0x00, 0x00, 0x06, 0x05, 0x00}), + + // ZSOFT Paintbrush file_1 + (FileType.PCX, new byte[] {0x0A, 0x02, 0x01, 0x01}), + + // ZSOFT Paintbrush file_2 + (FileType.PCX, new byte[] {0x0A, 0x03, 0x01, 0x01}), + + // ZSOFT Paintbrush file_3 + (FileType.PCX, new byte[] {0x0A, 0x05, 0x01, 0x01}), + + // MultiBit Bitcoin wallet file + (FileType.WALLET, new byte[] {0x0A, 0x16, 0x6F, 0x72, 0x67, 0x2E, 0x62, 0x69, 0x74, 0x63, 0x6F, 0x69, 0x6E, 0x2E, 0x70, 0x72}), + + // Monochrome Picture TIFF bitmap + (FileType.MP, new byte[] {0x0C, 0xED}), + + // DeskMate Document + (FileType.DOC, new byte[] {0x0D, 0x44, 0x4F, 0x43}), + + // Nero CD compilation + (FileType.NRI, new byte[] {0x0E, 0x4E, 0x65, 0x72, 0x6F, 0x49, 0x53, 0x4F}), + + // DeskMate Worksheet + (FileType.WKS, new byte[] {0x0E, 0x57, 0x4B, 0x53}), + + // PowerPoint presentation subheader_2 + (FileType.PPT, new byte[] {0x0F, 0x00, 0xE8, 0x03}), + + // Sibelius Music - Score + (FileType.SIB, new byte[] {0x0F, 0x53, 0x49, 0x42, 0x45, 0x4C, 0x49, 0x55, 0x53}), + + // Easy CD Creator 5 Layout file + (FileType.CL5, new byte[] {0x10, 0x00, 0x00, 0x00}), + + // Windows prefetch file + (FileType.PF, new byte[] {0x11, 0x00, 0x00, 0x00, 0x53, 0x43, 0x43, 0x41}), + + // Lotus Notes database template + (FileType.NTF, new byte[] {0x1A, 0x00, 0x00}), + + // Lotus Notes database + (FileType.NSF, new byte[] {0x1A, 0x00, 0x00, 0x04, 0x00, 0x00}), + + // LH archive (old vers.-type 1) + (FileType.ARC, new byte[] {0x1A, 0x02}), + + // LH archive (old vers.-type 2) + (FileType.ARC, new byte[] {0x1A, 0x03}), + + // LH archive (old vers.-type 3) + (FileType.ARC, new byte[] {0x1A, 0x04}), + + // LH archive (old vers.-type 4) + (FileType.ARC, new byte[] {0x1A, 0x08}), + + // LH archive (old vers.-type 5) + (FileType.ARC, new byte[] {0x1A, 0x09}), + + // Compressed archive file + (FileType.PAK, new byte[] {0x1A, 0x0B}), + + // WinPharoah capture file + (FileType.ETH, new byte[] {0x1A, 0x35, 0x01, 0x00}), + + // WebM video file + (FileType.WEBM, new byte[] {0x1A, 0x45, 0xDF, 0xA3}), + + // Matroska stream file_1 + (FileType.MKV, new byte[] {0x1A, 0x45, 0xDF, 0xA3}), + + // Matroska stream file_2 + (FileType.MKV, new byte[] {0x1A, 0x45, 0xDF, 0xA3, 0x93, 0x42, 0x82, 0x88}), + + // Runtime Software disk image + (FileType.DAT, new byte[] {0x1A, 0x52, 0x54, 0x53, 0x20, 0x43, 0x4F, 0x4D}), + + // WordStar Version 5.0-6.0 document + (FileType.WS, new byte[] {0x1D, 0x7D}), + + // GZIP archive file + (FileType.GZ, new byte[] {0x1F, 0x8B, 0x08}), + + // VLC Player Skin file + (FileType.VLT, new byte[] {0x1F, 0x8B, 0x08}), + + // Compressed tape archive_1 + (FileType.TARZ, new byte[] {0x1F, 0x9D, 0x90}), + + // Compressed tape archive_2 + (FileType.TARZ, new byte[] {0x1F, 0xA0}), + + // MapInfo Sea Chart + (FileType.BSB, new byte[] {0x21}), + + // AIN Compressed Archive + (FileType.AIN, new byte[] {0x21, 0x12}), + + // Unix archiver (ar)-MS Program Library Common Object File Format (COFF) + (FileType.LIB, new byte[] {0x21, 0x3C, 0x61, 0x72, 0x63, 0x68, 0x3E, 0x0A}), + + // Microsoft Outlook Exchange Offline Storage Folder + (FileType.OST, new byte[] {0x21, 0x42, 0x44, 0x4E}), + + // Cerius2 file + (FileType.MSI, new byte[] {0x23, 0x20}), + + // VMware 4 Virtual Disk description + (FileType.VMDK, new byte[] {0x23, 0x20, 0x44, 0x69, 0x73, 0x6B, 0x20, 0x44}), + + // MS Developer Studio project file + (FileType.DSP, new byte[] {0x23, 0x20, 0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73}), + + // Adaptive Multi-Rate ACELP Codec (GSM) + (FileType.AMR, new byte[] {0x23, 0x21, 0x41, 0x4D, 0x52}), + + // Skype audio compression + (FileType.SIL, new byte[] {0x23, 0x21, 0x53, 0x49, 0x4C, 0x4B, 0x0A}), + + // Radiance High Dynamic Range image file + (FileType.HDR, new byte[] {0x23, 0x3F, 0x52, 0x41, 0x44, 0x49, 0x41, 0x4E}), + + // VBScript Encoded script + (FileType.VBE, new byte[] {0x23, 0x40, 0x7E, 0x5E}), + + // Brother-Babylock-Bernina Home Embroidery + (FileType.PEC, new byte[] {0x23, 0x50, 0x45, 0x43, 0x30, 0x30, 0x30, 0x31}), + + // Brother-Babylock-Bernina Home Embroidery + (FileType.PES, new byte[] {0x23, 0x50, 0x45, 0x53, 0x30}), + + // SPSS Data file + (FileType.SAV, new byte[] {0x24, 0x46, 0x4C, 0x32, 0x40, 0x28, 0x23, 0x29}), + + // Encapsulated PostScript file + (FileType.EPS, new byte[] {0x25, 0x21, 0x50, 0x53, 0x2D, 0x41, 0x64, 0x6F}), + + // PDF file + (FileType.PDF, new byte[] {0x25, 0x50, 0x44, 0x46}), + + // PDF file + (FileType.FDF, new byte[] {0x25, 0x50, 0x44, 0x46}), + + // Fuzzy bitmap (FBM) file + (FileType.FBM, new byte[] {0x25, 0x62, 0x69, 0x74, 0x6D, 0x61, 0x70}), + + // BinHex 4 Compressed Archive + (FileType.HQX, new byte[] {0x28, 0x54, 0x68, 0x69, 0x73, 0x20, 0x66, 0x69}), + + // Symantec Wise Installer log + (FileType.LOG, new byte[] {0x2A, 0x2A, 0x2A, 0x20, 0x20, 0x49, 0x6E, 0x73}), + + // Compressed archive + (FileType.LHA, new byte[] {0x2D, 0x6C, 0x68}), + + // Compressed archive + (FileType.LZH, new byte[] {0x2D, 0x6C, 0x68}), + + // RealPlayer video file (V11+) + (FileType.IVR, new byte[] {0x2E, 0x52, 0x45, 0x43}), + + // RealMedia streaming media + (FileType.RM, new byte[] {0x2E, 0x52, 0x4D, 0x46}), + + // RealMedia streaming media + (FileType.RMVB, new byte[] {0x2E, 0x52, 0x4D, 0x46}), + + // RealAudio file + (FileType.RA, new byte[] {0x2E, 0x52, 0x4D, 0x46, 0x00, 0x00, 0x00, 0x12}), + + // RealAudio streaming media + (FileType.RA, new byte[] {0x2E, 0x72, 0x61, 0xFD, 0x00}), + + // NeXT-Sun Microsystems audio file + (FileType.AU, new byte[] {0x2E, 0x73, 0x6E, 0x64}), + + // Thunderbird-Mozilla Mail Summary File + (FileType.MSF, new byte[] {0x2F, 0x2F, 0x20, 0x3C, 0x21, 0x2D, 0x2D, 0x20, 0x3C, 0x6D, 0x64, 0x62, 0x3A, 0x6D, 0x6F, 0x72, 0x6B, 0x3A, 0x7A}), + + // MS security catalog file + (FileType.CAT, new byte[] {0x30}), + + // Windows Event Viewer file + (FileType.EVT, new byte[] {0x30, 0x00, 0x00, 0x00, 0x4C, 0x66, 0x4C, 0x65}), + + // GEnealogical Data COMmunication (GEDCOM) file + (FileType.GED, new byte[] {0x30, 0x20, 0x48, 0x45, 0x41, 0x44}), + + // Windows Media Audio-Video File + (FileType.ASF, new byte[] {0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11}), + + // Windows Media Audio-Video File + (FileType.WMA, new byte[] {0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11}), + + // Windows Media Audio-Video File + (FileType.WMV, new byte[] {0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11}), + + // National Transfer Format Map + (FileType.NTF, new byte[] {0x30, 0x31, 0x4F, 0x52, 0x44, 0x4E, 0x41, 0x4E}), + + // MS Write file_1 + (FileType.WRI, new byte[] {0x31, 0xBE}), + + // MS Write file_2 + (FileType.WRI, new byte[] {0x32, 0xBE}), + + // Pfaff Home Embroidery + (FileType.PCS, new byte[] {0x32, 0x03, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0xFF, 0x00}), + + // 7-Zip compressed file + (FileType._7Z, new byte[] {0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C}), + + // Photoshop image + (FileType.PSD, new byte[] {0x38, 0x42, 0x50, 0x53}), + + // Surfplan kite project file + (FileType.SLE, new byte[] {0x3A, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4F, 0x4E}), + + // Advanced Stream Redirector + (FileType.ASX, new byte[] {0x3C}), + + // BizTalk XML-Data Reduced Schema + (FileType.XDR, new byte[] {0x3C}), + + // AOL HTML mail + (FileType.DCI, new byte[] {0x3C, 0x21, 0x64, 0x6F, 0x63, 0x74, 0x79, 0x70}), + + // Windows Script Component + (FileType.WSC, new byte[] {0x3C, 0x3F}), + + // Windows Visual Stylesheet + (FileType.MANIFEST, new byte[] {0x3C, 0x3F, 0x78, 0x6D, 0x6C, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D}), + + // User Interface Language + (FileType.XML, new byte[] {0x3C, 0x3F, 0x78, 0x6D, 0x6C, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x22, 0x31, 0x2E, 0x30, 0x22, 0x3F, 0x3E}), + + // MMC Snap-in Control file + (FileType.MSC, new byte[] {0x3C, 0x3F, 0x78, 0x6D, 0x6C, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x22, 0x31, 0x2E, 0x30, 0x22, 0x3F, 0x3E, 0x0D, 0x0A, 0x3C, 0x4D, 0x4D, 0x43, 0x5F, 0x43, 0x6F, 0x6E, 0x73, 0x6F, 0x6C, 0x65, 0x46, 0x69, 0x6C, 0x65, 0x20, 0x43, 0x6F, 0x6E, 0x73, 0x6F, 0x6C, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x22}), + + // Picasa movie project file + (FileType.MXF, new byte[] {0x3C, 0x43, 0x54, 0x72, 0x61, 0x6E, 0x73, 0x54, 0x69, 0x6D, 0x65, 0x6C, 0x69, 0x6E, 0x65, 0x3E}), + + // Csound music + (FileType.CSD, new byte[] {0x3C, 0x43, 0x73, 0x6F, 0x75, 0x6E, 0x64, 0x53, 0x79, 0x6E, 0x74, 0x68, 0x65, 0x73, 0x69, 0x7A}), + + // Adobe FrameMaker + (FileType.FM, new byte[] {0x3C, 0x4D, 0x61, 0x6B, 0x65, 0x72, 0x46, 0x69}), + + // Adobe FrameMaker + (FileType.MIF, new byte[] {0x3C, 0x4D, 0x61, 0x6B, 0x65, 0x72, 0x46, 0x69}), + + // GPS Exchange (v1.1) + (FileType.GPX, new byte[] {0x3C, 0x67, 0x70, 0x78, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x22, 0x31, 0x2E}), + + // BASE85 file + (FileType.B85, new byte[] {0x3C, 0x7E, 0x36, 0x3C, 0x5C, 0x25, 0x5F, 0x30, 0x67, 0x53, 0x71, 0x68, 0x3B}), + + // Quatro Pro for Windows 7.0 + (FileType.WB3, new byte[] {0x3E, 0x00, 0x03, 0x00, 0xFE, 0xFF, 0x09, 0x00, 0x06}), + + // Windows Help file_2 + (FileType.GID, new byte[] {0x3F, 0x5F, 0x03, 0x00}), + + // Windows Help file_2 + (FileType.HLP, new byte[] {0x3F, 0x5F, 0x03, 0x00}), + + // EndNote Library File + (FileType.ENL, new byte[] {0x40, 0x40, 0x40, 0x20, 0x00, 0x00, 0x40, 0x40, 0x40, 0x40}), + + // Generic AutoCAD drawing + (FileType.DWG, new byte[] {0x41, 0x43, 0x31, 0x30}), + + // Steganos virtual secure drive + (FileType.SLE, new byte[] {0x41, 0x43, 0x76}), + + // Harvard Graphics symbol graphic + (FileType.SYW, new byte[] {0x41, 0x4D, 0x59, 0x4F}), + + // AOL config files + (FileType.ABI, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL config files + (FileType.ABY, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL config files + (FileType.BAG, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL config files + (FileType.IDX, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL config files + (FileType.IND, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL config files + (FileType.PFC, new byte[] {0x41, 0x4F, 0x4C}), + + // AOL and AIM buddy list + (FileType.BAG, new byte[] {0x41, 0x4F, 0x4C, 0x20, 0x46, 0x65, 0x65, 0x64}), + + // AOL address book + (FileType.ABY, new byte[] {0x41, 0x4F, 0x4C, 0x44, 0x42}), + + // AOL user configuration + (FileType.IDX, new byte[] {0x41, 0x4F, 0x4C, 0x44, 0x42}), + + // AOL client preferences-settings file + (FileType.IND, new byte[] {0x41, 0x4F, 0x4C, 0x49, 0x44, 0x58}), + + // AOL address book index + (FileType.ABI, new byte[] {0x41, 0x4F, 0x4C, 0x49, 0x4E, 0x44, 0x45, 0x58}), + + // AOL personal file cabinet + (FileType.ORG, new byte[] {0x41, 0x4F, 0x4C, 0x56, 0x4D, 0x31, 0x30, 0x30}), + + // AOL personal file cabinet + (FileType.PFC, new byte[] {0x41, 0x4F, 0x4C, 0x56, 0x4D, 0x31, 0x30, 0x30}), + + // AVG6 Integrity database + (FileType.DAT, new byte[] {0x41, 0x56, 0x47, 0x36, 0x5F, 0x49, 0x6E, 0x74}), + + // RIFF Windows Audio + (FileType.AVI, new byte[] {0x41, 0x56, 0x49, 0x20, 0x4C, 0x49, 0x53, 0x54}), + + // FreeArc compressed file + (FileType.ARC, new byte[] {0x41, 0x72, 0x43, 0x01}), + + // vCard + (FileType.VCF, new byte[] {0x42, 0x45, 0x47, 0x49, 0x4E, 0x3A, 0x56, 0x43}), + + // Speedtouch router firmware + (FileType.BIN, new byte[] {0x42, 0x4C, 0x49, 0x32, 0x32, 0x33}), + + // Speedtouch router firmware + (FileType.BLI, new byte[] {0x42, 0x4C, 0x49, 0x32, 0x32, 0x33}), + + // Speedtouch router firmware + (FileType.RBI, new byte[] {0x42, 0x4C, 0x49, 0x32, 0x32, 0x33}), + + // Bitmap image + (FileType.BMP, new byte[] {0x42, 0x4D}), + + // Bitmap image + (FileType.DIB, new byte[] {0x42, 0x4D}), + + // Palmpilot resource file + (FileType.PRC, new byte[] {0x42, 0x4F, 0x4F, 0x4B, 0x4D, 0x4F, 0x42, 0x49}), + + // Better Portable Graphics + (FileType.BPG, new byte[] {0x42, 0x50, 0x47, 0xFB}), + + // bzip2 compressed archive + (FileType.BZ2, new byte[] {0x42, 0x5A, 0x68}), + + // bzip2 compressed archive + (FileType.TAR, new byte[] {0x42, 0x5A, 0x68}), + + // bzip2 compressed archive + (FileType.BZ2, new byte[] {0x42, 0x5A, 0x68}), + + // bzip2 compressed archive + (FileType.TBZ2, new byte[] {0x42, 0x5A, 0x68}), + + // bzip2 compressed archive + (FileType.TB2, new byte[] {0x42, 0x5A, 0x68}), + + // Mac Disk image (BZ2 compressed) + (FileType.DMG, new byte[] {0x42, 0x5A, 0x68}), + + // Puffer ASCII encrypted archive + (FileType.APUF, new byte[] {0x42, 0x65, 0x67, 0x69, 0x6E, 0x20, 0x50, 0x75, 0x66, 0x66, 0x65, 0x72}), + + // Blink compressed archive + (FileType.BLI, new byte[] {0x42, 0x6C, 0x69, 0x6E, 0x6B}), + + // RagTime document + (FileType.RTD, new byte[] {0x43, 0x23, 0x2B, 0x44, 0xA4, 0x43, 0x4D, 0xA5}), + + // EA Interchange Format File (IFF)_3 + (FileType.IFF, new byte[] {0x43, 0x41, 0x54, 0x20}), + + // WordPerfect dictionary + (FileType.CBD, new byte[] {0x43, 0x42, 0x46, 0x49, 0x4C, 0x45}), + + // ISO-9660 CD Disc Image + (FileType.ISO, new byte[] {0x43, 0x44, 0x30, 0x30, 0x31}), + + // RIFF CD audio + (FileType.CDA, new byte[] {0x43, 0x44, 0x44, 0x41, 0x66, 0x6D, 0x74, 0x20}), + + // Compressed ISO CD image + (FileType.CSO, new byte[] {0x43, 0x49, 0x53, 0x4F}), + + // Windows 7 thumbnail + (FileType.DB, new byte[] {0x43, 0x4D, 0x4D, 0x4D, 0x15, 0x00, 0x00, 0x00}), + + // Corel Binary metafile + (FileType.CLB, new byte[] {0x43, 0x4D, 0x58, 0x31}), + + // COM+ Catalog + (FileType.CLB, new byte[] {0x43, 0x4F, 0x4D, 0x2B}), + + // VMware 3 Virtual Disk + (FileType.VMDK, new byte[] {0x43, 0x4F, 0x57, 0x44}), + + // Corel Photopaint file_1 + (FileType.CPT, new byte[] {0x43, 0x50, 0x54, 0x37, 0x46, 0x49, 0x4C, 0x45}), + + // Corel Photopaint file_2 + (FileType.CPT, new byte[] {0x43, 0x50, 0x54, 0x46, 0x49, 0x4C, 0x45}), + + // Win9x registry hive + (FileType.DAT, new byte[] {0x43, 0x52, 0x45, 0x47}), + + // Crush compressed archive + (FileType.CRU, new byte[] {0x43, 0x52, 0x55, 0x53, 0x48, 0x20, 0x76}), + + // Shockwave Flash file + (FileType.SWF, new byte[] {0x43, 0x57, 0x53}), + + // Calculux Indoor lighting project file + (FileType.CIN, new byte[] {0x43, 0x61, 0x6C, 0x63, 0x75, 0x6C, 0x75, 0x78, 0x20, 0x49, 0x6E, 0x64, 0x6F, 0x6F, 0x72, 0x20}), + + // WhereIsIt Catalog + (FileType.CTF, new byte[] {0x43, 0x61, 0x74, 0x61, 0x6C, 0x6F, 0x67, 0x20}), + + // IE History file + (FileType.DAT, new byte[] {0x43, 0x6C, 0x69, 0x65, 0x6E, 0x74, 0x20, 0x55}), + + // Google Chrome Extension + (FileType.CRX, new byte[] {0x43, 0x72, 0x32, 0x34}), + + // Creative Voice + (FileType.VOC, new byte[] {0x43, 0x72, 0x65, 0x61, 0x74, 0x69, 0x76, 0x65, 0x20, 0x56, 0x6F, 0x69, 0x63, 0x65, 0x20, 0x46}), + + // PowerISO Direct-Access-Archive image + (FileType.DAA, new byte[] {0x44, 0x41, 0x41, 0x00, 0x00, 0x00, 0x00, 0x00}), + + // DAX Compressed CD image + (FileType.DAX, new byte[] {0x44, 0x41, 0x58, 0x00}), + + // Palm Zire photo database + (FileType.DB, new byte[] {0x44, 0x42, 0x46, 0x48}), + + // Amiga DiskMasher compressed archive + (FileType.DMS, new byte[] {0x44, 0x4D, 0x53, 0x21}), + + // Amiga disk file + (FileType.ADF, new byte[] {0x44, 0x4F, 0x53}), + + // DST Compression + (FileType.DST, new byte[] {0x44, 0x53, 0x54, 0x62}), + + // DVR-Studio stream file + (FileType.DVR, new byte[] {0x44, 0x56, 0x44}), + + // DVD info file + (FileType.IFO, new byte[] {0x44, 0x56, 0x44}), + + // Elite Plus Commander game file + (FileType.CDR, new byte[] {0x45, 0x4C, 0x49, 0x54, 0x45, 0x20, 0x43, 0x6F}), + + // VideoVCD-VCDImager file + (FileType.VCD, new byte[] {0x45, 0x4E, 0x54, 0x52, 0x59, 0x56, 0x43, 0x44}), + + // Apple ISO 9660-HFS hybrid CD image + (FileType.ISO, new byte[] {0x45, 0x52, 0x02, 0x00, 0x00}), + + // EasyRecovery Saved State file + (FileType.DAT, new byte[] {0x45, 0x52, 0x46, 0x53, 0x53, 0x41, 0x56, 0x45}), + + // DSD Storage Facility audio file + (FileType.DSF, new byte[] {0x44, 0x53, 0x44, 0x20}), + + // MS Document Imaging file + (FileType.MDI, new byte[] {0x45, 0x50}), + + // Expert Witness Compression Format + (FileType.E01, new byte[] {0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}), + + // EnCase Evidence File Format V2 + (FileType.Ex01, new byte[] {0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81}), + + // Windows Vista event log + (FileType.EVTX, new byte[] {0x45, 0x6C, 0x66, 0x46, 0x69, 0x6C, 0x65, 0x00}), + + // QuickBooks backup + (FileType.QBB, new byte[] {0x45, 0x86, 0x00, 0x00, 0x06, 0x00}), + + // MS Fax Cover Sheet + (FileType.CPE, new byte[] {0x46, 0x41, 0x58, 0x43, 0x4F, 0x56, 0x45, 0x52}), + + // Fiasco database definition file + (FileType.FDB, new byte[] {0x46, 0x44, 0x42, 0x48, 0x00}), + + // Flash video file + (FileType.FLV, new byte[] {0x46, 0x4C, 0x56}), + + // IFF ANIM file + (FileType.ANM, new byte[] {0x46, 0x4F, 0x52, 0x4D}), + + // EA Interchange Format File (IFF)_1 + (FileType.IFF, new byte[] {0x46, 0x4F, 0x52, 0x4D}), + + // Audio Interchange File + (FileType.AIFF, new byte[] {0x46, 0x4F, 0x52, 0x4D, 0x00}), + + // DAKX Compressed Audio + (FileType.DAX, new byte[] {0x46, 0x4F, 0x52, 0x4D, 0x00}), + + // Shockwave Flash player + (FileType.SWF, new byte[] {0x46, 0x57, 0x53}), + + // Generic e-mail_2 + (FileType.EML, new byte[] {0x46, 0x72, 0x6F, 0x6D}), + + // GIF file + (FileType.GIF, new byte[] {0x47, 0x49, 0x46, 0x38}), + + // GIMP pattern file + (FileType.PAT, new byte[] {0x47, 0x50, 0x41, 0x54}), + + // General Regularly-distributed Information (GRIdded) Binary + (FileType.GRB, new byte[] {0x47, 0x52, 0x49, 0x42}), + + // Show Partner graphics file + (FileType.GX2, new byte[] {0x47, 0x58, 0x32}), + + // Genetec video archive + (FileType.G64, new byte[] {0x47, 0x65, 0x6E, 0x65, 0x74, 0x65, 0x63, 0x20, 0x4F, 0x6D, 0x6E, 0x69, 0x63, 0x61, 0x73, 0x74}), + + // SAS Transport dataset + (FileType.XPT, new byte[] {0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x20, 0x52, 0x45, 0x43, 0x4F, 0x52, 0x44, 0x2A, 0x2A, 0x2A}), + + // Harvard Graphics presentation file + (FileType.SH3, new byte[] {0x48, 0x48, 0x47, 0x42, 0x31}), + + // TIFF file_1 + (FileType.TIF, new byte[] {0x49, 0x20, 0x49}), + + // TIFF file_1 + (FileType.TIFF, new byte[] {0x49, 0x20, 0x49}), + + // MP3 audio file + (FileType.MP3, new byte[] {0x49, 0x44, 0x33}), + + // Sprint Music Store audio + (FileType.KOZ, new byte[] {0x49, 0x44, 0x33, 0x03, 0x00, 0x00, 0x00}), + + // Canon RAW file + (FileType.CRW, new byte[] {0x49, 0x49, 0x1A, 0x00, 0x00, 0x00, 0x48, 0x45}), + + // TIFF file_2 + (FileType.TIF, new byte[] {0x49, 0x49, 0x2A, 0x00}), + + // TIFF file_2 + (FileType.TIFF, new byte[] {0x49, 0x49, 0x2A, 0x00}), + + // Windows 7 thumbnail_2 + (FileType.DB, new byte[] {0x49, 0x4D, 0x4D, 0x4D, 0x15, 0x00, 0x00, 0x00}), + + // Install Shield compressed file + (FileType.CAB, new byte[] {0x49, 0x53, 0x63, 0x28}), + + // Install Shield compressed file + (FileType.HDR, new byte[] {0x49, 0x53, 0x63, 0x28}), + + // MS Reader eBook + (FileType.LIT, new byte[] {0x49, 0x54, 0x4F, 0x4C, 0x49, 0x54, 0x4C, 0x53}), + + // MS Compiled HTML Help File + (FileType.CHI, new byte[] {0x49, 0x54, 0x53, 0x46}), + + // MS Compiled HTML Help File + (FileType.CHM, new byte[] {0x49, 0x54, 0x53, 0x46}), + + // Inno Setup Uninstall Log + (FileType.DAT, new byte[] {0x49, 0x6E, 0x6E, 0x6F, 0x20, 0x53, 0x65, 0x74}), + + // Inter@ctive Pager Backup (BlackBerry file + (FileType.IPD, new byte[] {0x49, 0x6E, 0x74, 0x65, 0x72, 0x40, 0x63, 0x74, 0x69, 0x76, 0x65, 0x20, 0x50, 0x61, 0x67, 0x65}), + + // JARCS compressed archive + (FileType.JAR, new byte[] {0x4A, 0x41, 0x52, 0x43, 0x53, 0x00}), + + // AOL ART file_1 + (FileType.JG, new byte[] {0x4A, 0x47, 0x03, 0x0E}), + + // AOL ART file_2 + (FileType.JG, new byte[] {0x4A, 0x47, 0x04, 0x0E}), + + // VMware 4 Virtual Disk + (FileType.VMDK, new byte[] {0x4B, 0x44, 0x4D}), + + // KGB archive + (FileType.KGB, new byte[] {0x4B, 0x47, 0x42, 0x5F, 0x61, 0x72, 0x63, 0x68}), + + // Win9x printer spool file + (FileType.SHD, new byte[] {0x4B, 0x49, 0x00, 0x00}), + + // Windows shortcut file + (FileType.LNK, new byte[] {0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00}), + + // MS COFF relocatable object code + (FileType.OBJ, new byte[] {0x4C, 0x01}), + + // Tajima emboridery + (FileType.DST, new byte[] {0x4C, 0x41, 0x3A}), + + // Windows help file_3 + (FileType.GID, new byte[] {0x4C, 0x4E, 0x02, 0x00}), + + // Windows help file_3 + (FileType.HLP, new byte[] {0x4C, 0x4E, 0x02, 0x00}), + + // EA Interchange Format File (IFF)_2 + (FileType.IFF, new byte[] {0x4C, 0x49, 0x53, 0x54}), + + // DeluxePaint Animation + (FileType.ANM, new byte[] {0x4C, 0x50, 0x46, 0x20, 0x00, 0x01}), + + // Logical File Evidence Format + (FileType.E01, new byte[] {0x4C, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}), + + // Merriam-Webster Pocket Dictionary + (FileType.PDB, new byte[] {0x4D, 0x2D, 0x57, 0x20, 0x50, 0x6F, 0x63, 0x6B}), + + // Mozilla archive + (FileType.MAR, new byte[] {0x4D, 0x41, 0x52, 0x31, 0x00}), + + // Microsoft-MSN MARC archive + (FileType.MAR, new byte[] {0x4D, 0x41, 0x52, 0x43}), + + // MATLAB v5 workspace + (FileType.MAT, new byte[] {0x4D, 0x41, 0x54, 0x4C, 0x41, 0x42, 0x20, 0x35, 0x2E, 0x30, 0x20, 0x4D, 0x41, 0x54, 0x2D, 0x66, 0x69, 0x6C, 0x65}), + + // MAr compressed archive + (FileType.MAR, new byte[] {0x4D, 0x41, 0x72, 0x30, 0x00}), + + // TargetExpress target file + (FileType.MTE, new byte[] {0x4D, 0x43, 0x57, 0x20, 0x54, 0x65, 0x63, 0x68, 0x6E, 0x6F, 0x67, 0x6F, 0x6C, 0x69, 0x65, 0x73}), + + // Windows dump file + (FileType.DMP, new byte[] {0x4D, 0x44, 0x4D, 0x50, 0x93, 0xA7}), + + // Windows dump file + (FileType.HDMP, new byte[] {0x4D, 0x44, 0x4D, 0x50, 0x93, 0xA7}), + + // Milestones project management file + (FileType.MLS, new byte[] {0x4D, 0x49, 0x4C, 0x45, 0x53}), + + // Skype localization data file + (FileType.MLS, new byte[] {0x4D, 0x4C, 0x53, 0x57}), + + // TIFF file_3 + (FileType.TIF, new byte[] {0x4D, 0x4D, 0x00, 0x2A}), + + // TIFF file_3 + (FileType.TIFF, new byte[] {0x4D, 0x4D, 0x00, 0x2A}), + + // TIFF file_4 + (FileType.TIF, new byte[] {0x4D, 0x4D, 0x00, 0x2B}), + + // TIFF file_4 + (FileType.TIFF, new byte[] {0x4D, 0x4D, 0x00, 0x2B}), + + // Yamaha Synthetic music Mobile Application Format + (FileType.MMF, new byte[] {0x4D, 0x4D, 0x4D, 0x44, 0x00, 0x00}), + + // VMware BIOS state file + (FileType.NVRAM, new byte[] {0x4D, 0x52, 0x56, 0x4E}), + + // Microsoft cabinet file + (FileType.CAB, new byte[] {0x4D, 0x53, 0x43, 0x46}), + + // OneNote Package + (FileType.ONEPKG, new byte[] {0x4D, 0x53, 0x43, 0x46}), + + // Powerpoint Packaged Presentation + (FileType.PPZ, new byte[] {0x4D, 0x53, 0x43, 0x46}), + + // MS Access Snapshot Viewer file + (FileType.SNP, new byte[] {0x4D, 0x53, 0x43, 0x46}), + + // OLE-SPSS-Visual C++ library file + (FileType.TLB, new byte[] {0x4D, 0x53, 0x46, 0x54, 0x02, 0x00, 0x01, 0x00}), + + // Microsoft Windows Imaging Format + (FileType.WIM, new byte[] {0x4D, 0x53, 0x57, 0x49, 0x4D}), + + // Sony Compressed Voice File + (FileType.CDR, new byte[] {0x4D, 0x53, 0x5F, 0x56, 0x4F, 0x49, 0x43, 0x45}), + + // Sony Compressed Voice File + (FileType.DVF, new byte[] {0x4D, 0x53, 0x5F, 0x56, 0x4F, 0x49, 0x43, 0x45}), + + // Sony Compressed Voice File + (FileType.MSV, new byte[] {0x4D, 0x53, 0x5F, 0x56, 0x4F, 0x49, 0x43, 0x45}), + + // MIDI sound file + (FileType.MID, new byte[] {0x4D, 0x54, 0x68, 0x64}), + + // MIDI sound file + (FileType.MIDI, new byte[] {0x4D, 0x54, 0x68, 0x64}), + + // Yamaha Piano + (FileType.PCS, new byte[] {0x4D, 0x54, 0x68, 0x64}), + + // CD Stomper Pro label file + (FileType.DSN, new byte[] {0x4D, 0x56}), + + // Milestones project management file_1 + (FileType.MLS, new byte[] {0x4D, 0x56, 0x32, 0x31, 0x34}), + + // Milestones project management file_2 + (FileType.MLS, new byte[] {0x4D, 0x56, 0x32, 0x43}), + + // Windows-DOS executable file + (FileType.COM, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.DLL, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.DRV, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.EXE, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.PIF, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.QTS, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.QTX, new byte[] {0x4D, 0x5A}), + + // Windows-DOS executable file + (FileType.SYS, new byte[] {0x4D, 0x5A}), + + // MS audio compression manager driver + (FileType.ACM, new byte[] {0x4D, 0x5A}), + + // Library cache file + (FileType.AX, new byte[] {0x4D, 0x5A}), + + // Control panel application + (FileType.CPL, new byte[] {0x4D, 0x5A}), + + // Font file + (FileType.FON, new byte[] {0x4D, 0x5A}), + + // ActiveX-OLE Custom Control + (FileType.OCX, new byte[] {0x4D, 0x5A}), + + // OLE object library + (FileType.OLB, new byte[] {0x4D, 0x5A}), + + // Screen saver + (FileType.SCR, new byte[] {0x4D, 0x5A}), + + // VisualBASIC application + (FileType.VBX, new byte[] {0x4D, 0x5A}), + + // Windows virtual device drivers + (FileType.VXD, new byte[] {0x4D, 0x5A}), + + // Windows virtual device drivers + (FileType._386, new byte[] {0x4D, 0x5A}), + + // Acrobat plug-in + (FileType.API, new byte[] {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00}), + + // DirectShow filter + (FileType.AX, new byte[] {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00}), + + // Audition graphic filter + (FileType.FLT, new byte[] {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00}), + + // ZoneAlam data file + (FileType.ZAP, new byte[] {0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF}), + + // MS C++ debugging symbols file + (FileType.PDB, new byte[] {0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73, 0x6F, 0x66, 0x74, 0x20, 0x43, 0x2F, 0x43, 0x2B, 0x2B, 0x20}), + + // Visual Studio .NET file + (FileType.SLN, new byte[] {0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73, 0x6F, 0x66, 0x74, 0x20, 0x56, 0x69, 0x73, 0x75, 0x61, 0x6C}), + + // Windows Media Player playlist + (FileType.WPL, new byte[] {0x4D, 0x69, 0x63, 0x72, 0x6F, 0x73, 0x6F, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20, 0x4D, 0x65, 0x64, 0x69, 0x61, 0x20, 0x50, 0x6C, 0x61, 0x79, 0x65, 0x72, 0x20, 0x2D, 0x2D, 0x20}), + + // VMapSource GPS Waypoint Database + (FileType.GDB, new byte[] {0x4D, 0x73, 0x52, 0x63, 0x66}), + + // TomTom traffic data + (FileType.DAT, new byte[] {0x4E, 0x41, 0x56, 0x54, 0x52, 0x41, 0x46, 0x46}), + + // MS Windows journal + (FileType.JNT, new byte[] {0x4E, 0x42, 0x2A, 0x00}), + + // MS Windows journal + (FileType.JTP, new byte[] {0x4E, 0x42, 0x2A, 0x00}), + + // NES Sound file + (FileType.NSF, new byte[] {0x4E, 0x45, 0x53, 0x4D, 0x1A, 0x01}), + + // National Imagery Transmission Format file + (FileType.NTF, new byte[] {0x4E, 0x49, 0x54, 0x46, 0x30}), + + // Agent newsreader character map + (FileType.COD, new byte[] {0x4E, 0x61, 0x6D, 0x65, 0x3A, 0x20}), + + // 1Password 4 Cloud Keychain + (FileType.attachment, new byte[] {0x4F, 0x50, 0x43, 0x4C, 0x44, 0x41, 0x54}), + + // Psion Series 3 Database + (FileType.DBF, new byte[] {0x4F, 0x50, 0x4C, 0x44, 0x61, 0x74, 0x61, 0x62}), + + // OpenType font + (FileType.OTF, new byte[] {0x4F, 0x54, 0x54, 0x4F, 0x00}), + + // Ogg Vorbis Codec compressed file + (FileType.OGA, new byte[] {0x4F, 0x67, 0x67, 0x53, 0x00, 0x02, 0x00, 0x00}), + + // Ogg Vorbis Codec compressed file + (FileType.OGG, new byte[] {0x4F, 0x67, 0x67, 0x53, 0x00, 0x02, 0x00, 0x00}), + + // Ogg Vorbis Codec compressed file + (FileType.OGV, new byte[] {0x4F, 0x67, 0x67, 0x53, 0x00, 0x02, 0x00, 0x00}), + + // Ogg Vorbis Codec compressed file + (FileType.OGX, new byte[] {0x4F, 0x67, 0x67, 0x53, 0x00, 0x02, 0x00, 0x00}), + + // Visio-DisplayWrite 4 text file + (FileType.DW4, new byte[] {0x4F, 0x7B}), + + // Quicken QuickFinder Information File + (FileType.IDX, new byte[] {0x50, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00}), + + // Portable Graymap Graphic + (FileType.PGM, new byte[] {0x50, 0x35, 0x0A}), + + // Quake archive file + (FileType.PAK, new byte[] {0x50, 0x41, 0x43, 0x4B}), + + // Windows memory dump + (FileType.DMP, new byte[] {0x50, 0x41, 0x47, 0x45, 0x44, 0x55}), + + // PAX password protected bitmap + (FileType.PAX, new byte[] {0x50, 0x41, 0x58}), + + // PestPatrol data-scan strings + (FileType.DAT, new byte[] {0x50, 0x45, 0x53, 0x54}), + + // PGP disk image + (FileType.PGD, new byte[] {0x50, 0x47, 0x50, 0x64, 0x4D, 0x41, 0x49, 0x4E}), + + // ChromaGraph Graphics Card Bitmap + (FileType.IMG, new byte[] {0x50, 0x49, 0x43, 0x54, 0x00, 0x08}), + + // PKZIP archive_1 + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Android package + (FileType.APK, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // MacOS X Dashboard Widget + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // MS Office Open XML Format Document + (FileType.DOCX, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // MS Office Open XML Format Document + (FileType.PPTX, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // MS Office Open XML Format Document + (FileType.XLSX, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Java archive_1 + (FileType.JAR, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Google Earth session file + (FileType.KMZ, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // KWord document + (FileType.KWD, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenDocument template + (FileType.ODT, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenDocument template + (FileType.ODP, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenDocument template + (FileType.OTT, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Microsoft Open XML paper specification + (FileType.OXPS, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenOffice documents + (FileType.SXC, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenOffice documents + (FileType.SXD, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenOffice documents + (FileType.SXI, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // OpenOffice documents + (FileType.SXW, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // StarOffice spreadsheet + (FileType.SXC, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Windows Media compressed skin file + (FileType.WMZ, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Mozilla Browser Archive + (FileType.XPI, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // XML paper specification file + (FileType.XPS, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // eXact Packager Models + (FileType.XPT, new byte[] {0x50, 0x4B, 0x03, 0x04}), + + // Open Publication Structure eBook + (FileType.EPUB, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x0A, 0x00, 0x02, 0x00}), + + // ZLock Pro encrypted ZIP + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x01, 0x00}), + + // MS Office 2007 documents + (FileType.DOCX, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x06, 0x00}), + + // MS Office 2007 documents + (FileType.PPTX, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x06, 0x00}), + + // MS Office 2007 documents + (FileType.XLSX, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x06, 0x00}), + + // Java archive_2 + (FileType.JAR, new byte[] {0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00}), + + // PKZIP archive_2 + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x05, 0x06}), + + // PKZIP archive_3 + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x07, 0x08}), + + // PKLITE archive + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x4C, 0x49, 0x54, 0x45}), + + // PKSFX self-extracting archive + (FileType.ZIP, new byte[] {0x50, 0x4B, 0x53, 0x70, 0x58}), + + // Windows Program Manager group file + (FileType.GRP, new byte[] {0x50, 0x4D, 0x43, 0x43}), + + // Norton Disk Doctor undo file + (FileType.DAT, new byte[] {0x50, 0x4E, 0x43, 0x49, 0x55, 0x4E, 0x44, 0x4F}), + + // Microsoft Windows User State Migration Tool + (FileType.PMOCCMOC, new byte[] {0x50, 0x4D, 0x4F, 0x43, 0x43, 0x4D, 0x4F, 0x43}), + + // Dreamcast Sound Format + (FileType.DSF, new byte[] {0x50, 0x53, 0x46, 0x12}), + + // Puffer encrypted archive + (FileType.PUF, new byte[] {0x50, 0x55, 0x46, 0x58}), + + // Quicken data + (FileType.QEL, new byte[] {0x51, 0x45, 0x4C, 0x20}), + + // Qcow Disk Image + (FileType.QEMU, new byte[] {0x51, 0x46, 0x49}), + + // RIFF Qualcomm PureVoice + (FileType.QCP, new byte[] {0x51, 0x4C, 0x43, 0x4D, 0x66, 0x6D, 0x74, 0x20}), + + // Quicken data file + (FileType.ABD, new byte[] {0x51, 0x57, 0x20, 0x56, 0x65, 0x72, 0x2E, 0x20}), + + // Quicken data file + (FileType.QSD, new byte[] {0x51, 0x57, 0x20, 0x56, 0x65, 0x72, 0x2E, 0x20}), + + // Outlook-Exchange message subheader + (FileType.MSG, new byte[] {0x52, 0x00, 0x6F, 0x00, 0x6F, 0x00, 0x74, 0x00, 0x20, 0x00, 0x45, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x72, 0x00, 0x79, 0x00}), + + // Shareaza (P2P) thumbnail + (FileType.DAT, new byte[] {0x52, 0x41, 0x5A, 0x41, 0x54, 0x44, 0x42, 0x31}), + + // R saved work space + (FileType.RDATA, new byte[] {0x52, 0x44, 0x58, 0x32, 0x0A}), + + // WinNT Registry-Registry Undo files + (FileType.REG, new byte[] {0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54}), + + // WinNT Registry-Registry Undo files + (FileType.SUD, new byte[] {0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54}), + + // Antenna data file + (FileType.AD, new byte[] {0x52, 0x45, 0x56, 0x4E, 0x55, 0x4D, 0x3A, 0x2C}), + + // Windows animated cursor + (FileType.ANI, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Corel Presentation Exchange metadata + (FileType.CMX, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // CorelDraw document + (FileType.CDR, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Video CD MPEG movie + (FileType.DAT, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Micrografx Designer graphic + (FileType.DS4, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // 4X Movie video + (FileType._4XM, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.AVI, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.CDA, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.QCP, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.RMI, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.WAV, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // Resource Interchange File Format + (FileType.WEBP, new byte[] {0x52, 0x49, 0x46, 0x46}), + + // RIFF Windows MIDI + (FileType.RMI, new byte[] {0x52, 0x4D, 0x49, 0x44, 0x64, 0x61, 0x74, 0x61}), + + // WinNT Netmon capture file + (FileType.CAP, new byte[] {0x52, 0x54, 0x53, 0x53}), + + // WinRAR compressed archive + (FileType.RAR, new byte[] {0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00}), + + // Generic e-mail_1 + (FileType.EML, new byte[] {0x52, 0x65, 0x74, 0x75, 0x72, 0x6E, 0x2D, 0x50}), + + // Windows prefetch + (FileType.PF, new byte[] {0x53, 0x43, 0x43, 0x41}), + + // Underground Audio + (FileType.AST, new byte[] {0x53, 0x43, 0x48, 0x6C}), + + // Img Software Bitmap + (FileType.IMG, new byte[] {0x53, 0x43, 0x4D, 0x49}), + + // SMPTE DPX (big endian) + (FileType.SDPX, new byte[] {0x53, 0x44, 0x50, 0x58}), + + // Harvard Graphics presentation + (FileType.SHW, new byte[] {0x53, 0x48, 0x4F, 0x57}), + + // Sietronics CPI XRD document + (FileType.CPI, new byte[] {0x53, 0x49, 0x45, 0x54, 0x52, 0x4F, 0x4E, 0x49}), + + // Flexible Image Transport System (FITS) file + (FileType.FITS, new byte[] {0x53, 0x49, 0x4D, 0x50, 0x4C, 0x45, 0x20, 0x20, 0x3D, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x54}), + + // StuffIt archive + (FileType.SIT, new byte[] {0x53, 0x49, 0x54, 0x21, 0x00}), + + // SmartDraw Drawing file + (FileType.SDR, new byte[] {0x53, 0x4D, 0x41, 0x52, 0x54, 0x44, 0x52, 0x57}), + + // StorageCraft ShadownProtect backup file + (FileType.SPF, new byte[] {0x53, 0x50, 0x46, 0x49, 0x00}), + + // MultiBit Bitcoin blockchain file + (FileType.SPVB, new byte[] {0x53, 0x50, 0x56, 0x42}), + + // SQLite database file + (FileType.DB, new byte[] {0x53, 0x51, 0x4C, 0x69, 0x74, 0x65, 0x20, 0x66, 0x6F, 0x72, 0x6D, 0x61, 0x74, 0x20, 0x33, 0x00}), + + // DB2 conversion file + (FileType.CNV, new byte[] {0x53, 0x51, 0x4C, 0x4F, 0x43, 0x4F, 0x4E, 0x56}), + + // StuffIt compressed archive + (FileType.SIT, new byte[] {0x53, 0x74, 0x75, 0x66, 0x66, 0x49, 0x74, 0x20}), + + // SuperCalc worksheet + (FileType.CAL, new byte[] {0x53, 0x75, 0x70, 0x65, 0x72, 0x43, 0x61, 0x6C}), + + // Wii-GameCube + (FileType.THP, new byte[] {0x54, 0x48, 0x50, 0x00}), + + // GNU Info Reader file + (FileType.INFO, new byte[] {0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20}), + + // Unicode extensions + (FileType.UCE, new byte[] {0x55, 0x43, 0x45, 0x58}), + + // UFA compressed archive + (FileType.UFA, new byte[] {0x55, 0x46, 0x41, 0xC6, 0xD2, 0xC1}), + + // UFO Capture map file + (FileType.DAT, new byte[] {0x55, 0x46, 0x4F, 0x4F, 0x72, 0x62, 0x69, 0x74}), + + // Visual C PreCompiled header + (FileType.PCH, new byte[] {0x56, 0x43, 0x50, 0x43, 0x48, 0x30}), + + // Visual Basic User-defined Control file + (FileType.CTL, new byte[] {0x56, 0x45, 0x52, 0x53, 0x49, 0x4F, 0x4E, 0x20}), + + // MapInfo Interchange Format file + (FileType.MIF, new byte[] {0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x20}), + + // SPSS template + (FileType.SCT, new byte[] {0x57, 0x04, 0x00, 0x00, 0x53, 0x50, 0x53, 0x53, 0x20, 0x74, 0x65, 0x6D, 0x70, 0x6C, 0x61, 0x74}), + + // RIFF Windows Audio + (FileType.WAV, new byte[] {0x57, 0x41, 0x56, 0x45, 0x66, 0x6D, 0x74, 0x20}), + + // RIFF WebP + (FileType.WEBP, new byte[] {0x57, 0x45, 0x42, 0x50}), + + // Walkman MP3 file + (FileType.DAT, new byte[] {0x57, 0x4D, 0x4D, 0x50}), + + // WordStar for Windows file + (FileType.WS2, new byte[] {0x57, 0x53, 0x32, 0x30, 0x30, 0x30}), + + // WinZip compressed archive + (FileType.ZIP, new byte[] {0x57, 0x69, 0x6E, 0x5A, 0x69, 0x70}), + + // Lotus WordPro file + (FileType.LWP, new byte[] {0x57, 0x6F, 0x72, 0x64, 0x50, 0x72, 0x6F}), + + // Exchange e-mail + (FileType.EML, new byte[] {0x58, 0x2D}), + + // Packet sniffer files + (FileType.CAP, new byte[] {0x58, 0x43, 0x50, 0x00}), + + // XPCOM libraries + (FileType.XPT, new byte[] {0x58, 0x50, 0x43, 0x4F, 0x4D, 0x0A, 0x54, 0x79}), + + // SMPTE DPX file (little endian) + (FileType.DPX, new byte[] {0x58, 0x50, 0x44, 0x53}), + + // MS Publisher + (FileType.BDR, new byte[] {0x58, 0x54}), + + // ZOO compressed archive + (FileType.ZOO, new byte[] {0x5A, 0x4F, 0x4F, 0x20}), + + // Macromedia Shockwave Flash + (FileType.SWF, new byte[] {0x5A, 0x57, 0x53}), + + // MS Exchange configuration file + (FileType.ECF, new byte[] {0x5B, 0x47, 0x65, 0x6E, 0x65, 0x72, 0x61, 0x6C}), + + // Visual C++ Workbench Info File + (FileType.VCW, new byte[] {0x5B, 0x4D, 0x53, 0x56, 0x43}), + + // Dial-up networking file + (FileType.DUN, new byte[] {0x5B, 0x50, 0x68, 0x6F, 0x6E, 0x65, 0x5D}), + + // Lotus AMI Pro document_1 + (FileType.SAM, new byte[] {0x5B, 0x56, 0x45, 0x52, 0x5D}), + + // VocalTec VoIP media file + (FileType.VMD, new byte[] {0x5B, 0x56, 0x4D, 0x44, 0x5D}), + + // Microsoft Code Page Translation file + (FileType.CPX, new byte[] {0x5B, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73}), + + // Flight Simulator Aircraft Configuration + (FileType.CFG, new byte[] {0x5B, 0x66, 0x6C, 0x74, 0x73, 0x69, 0x6D, 0x2E}), + + // WinAmp Playlist + (FileType.PLS, new byte[] {0x5B, 0x70, 0x6C, 0x61, 0x79, 0x6C, 0x69, 0x73, 0x74, 0x5D}), + + // Lotus AMI Pro document_2 + (FileType.SAM, new byte[] {0x5B, 0x76, 0x65, 0x72, 0x5D}), + + // Husqvarna Designer + (FileType.HUS, new byte[] {0x5D, 0xFC, 0xC8, 0x00}), + + // Jar archive + (FileType.JAR, new byte[] {0x5F, 0x27, 0xA8, 0x89}), + + // EnCase case file + (FileType.CAS, new byte[] {0x5F, 0x43, 0x41, 0x53, 0x45, 0x5F}), + + // EnCase case file + (FileType.CBK, new byte[] {0x5F, 0x43, 0x41, 0x53, 0x45, 0x5F}), + + // Compressed archive file + (FileType.ARJ, new byte[] {0x60, 0xEA}), + + // UUencoded BASE64 file + (FileType.b64, new byte[] {0x62, 0x65, 0x67, 0x69, 0x6E, 0x2D, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34}), + + // Apple Core Audio File + (FileType.CAF, new byte[] {0x63, 0x61, 0x66, 0x66}), + + // Macintosh encrypted Disk image (v1) + (FileType.DMG, new byte[] {0x63, 0x64, 0x73, 0x61, 0x65, 0x6E, 0x63, 0x72}), + + // Virtual PC HD image + (FileType.VHD, new byte[] {0x63, 0x6F, 0x6E, 0x65, 0x63, 0x74, 0x69, 0x78}), + + // Photoshop Custom Shape + (FileType.CSH, new byte[] {0x63, 0x75, 0x73, 0x68, 0x00, 0x00, 0x00, 0x02}), + + // Intel PROset-Wireless Profile + (FileType.P10, new byte[] {0x64, 0x00, 0x00, 0x00}), + + // Torrent file + (FileType.TORRENT, new byte[] {0x64, 0x38, 0x3A, 0x61, 0x6E, 0x6E, 0x6F, 0x75, 0x6E, 0x63, 0x65}), + + // Dalvik (Android) executable file + (FileType.dex, new byte[] {0x64, 0x65, 0x78, 0x0A}), + + // Audacity audio file + (FileType.AU, new byte[] {0x64, 0x6E, 0x73, 0x2E}), + + // MS Visual Studio workspace file + (FileType.DSW, new byte[] {0x64, 0x73, 0x77, 0x66, 0x69, 0x6C, 0x65}), + + // Macintosh encrypted Disk image (v2) + (FileType.DMG, new byte[] {0x65, 0x6E, 0x63, 0x72, 0x63, 0x64, 0x73, 0x61}), + + // WinNT printer spool file + (FileType.SHD, new byte[] {0x66, 0x49, 0x00, 0x00}), + + // Free Lossless Audio Codec file + (FileType.FLAC, new byte[] {0x66, 0x4C, 0x61, 0x43, 0x00, 0x00, 0x00, 0x22}), + + // MPEG-4 video file_1 + (FileType.MP4, new byte[] {0x66, 0x74, 0x79, 0x70, 0x33, 0x67, 0x70, 0x35}), + + // Apple Lossless Audio Codec file + (FileType.M4A, new byte[] {0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x41, 0x20}), + + // ISO Media-MPEG v4-iTunes AVC-LC + (FileType.FLV, new byte[] {0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x56, 0x20}), + + // ISO Media-MPEG v4-iTunes AVC-LC + (FileType.M4V, new byte[] {0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x56, 0x20}), + + // MPEG-4 video file_2 + (FileType.MP4, new byte[] {0x66, 0x74, 0x79, 0x70, 0x4D, 0x53, 0x4E, 0x56}), + + // ISO Base Media file (MPEG-4) v1 + (FileType.MP4, new byte[] {0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6F, 0x6D}), + + // MPEG-4 video-QuickTime file + (FileType.M4V, new byte[] {0x66, 0x74, 0x79, 0x70, 0x6D, 0x70, 0x34, 0x32}), + + // QuickTime movie_7 + (FileType.MOV, new byte[] {0x66, 0x74, 0x79, 0x70, 0x71, 0x74, 0x20, 0x20}), + + // Win2000-XP printer spool file + (FileType.SHD, new byte[] {0x67, 0x49, 0x00, 0x00}), + + // GIMP file + (FileType.XCF, new byte[] {0x67, 0x69, 0x6d, 0x70, 0x20, 0x78, 0x63, 0x66}), + + // Win Server 2003 printer spool file + (FileType.SHD, new byte[] {0x68, 0x49, 0x00, 0x00}), + + // Skype user data file + (FileType.DBB, new byte[] {0x6C, 0x33, 0x33, 0x6C}), + + // QuickTime movie_1 + (FileType.MOV, new byte[] {0x6D, 0x6F, 0x6F, 0x76}), + + // QuickTime movie_2 + (FileType.MOV, new byte[] {0x66, 0x72, 0x65, 0x65}), + + // QuickTime movie_3 + (FileType.MOV, new byte[] {0x6D, 0x64, 0x61, 0x74}), + + // QuickTime movie_4 + (FileType.MOV, new byte[] {0x77, 0x69, 0x64, 0x65}), + + // QuickTime movie_5 + (FileType.MOV, new byte[] {0x70, 0x6E, 0x6F, 0x74}), + + // QuickTime movie_6 + (FileType.MOV, new byte[] {0x73, 0x6B, 0x69, 0x70}), + + // Internet Explorer v11 Tracking Protection List + (FileType.TPL, new byte[] {0x6D, 0x73, 0x46, 0x69, 0x6C, 0x74, 0x65, 0x72, 0x4C, 0x69, 0x73, 0x74}), + + // MultiBit Bitcoin wallet information + (FileType.INFO, new byte[] {0x6D, 0x75, 0x6C, 0x74, 0x69, 0x42, 0x69, 0x74, 0x2E, 0x69, 0x6E, 0x66, 0x6F}), + + // WinNT registry file + (FileType.DAT, new byte[] {0x72, 0x65, 0x67, 0x66}), + + // Sonic Foundry Acid Music File + (FileType.AC, new byte[] {0x72, 0x69, 0x66, 0x66}), + + // RealMedia metafile + (FileType.RAM, new byte[] {0x72, 0x74, 0x73, 0x70, 0x3A, 0x2F, 0x2F}), + + // Allegro Generic Packfile (compressed) + (FileType.DAT, new byte[] {0x73, 0x6C, 0x68, 0x21}), + + // Allegro Generic Packfile (uncompressed) + (FileType.DAT, new byte[] {0x73, 0x6C, 0x68, 0x2E}), + + // PalmOS SuperMemo + (FileType.PDB, new byte[] {0x73, 0x6D, 0x5F}), + + // STL (STereoLithography) file + (FileType.STL, new byte[] {0x73, 0x6F, 0x6C, 0x69, 0x64}), + + // CALS raster bitmap + (FileType.CAL, new byte[] {0x73, 0x72, 0x63, 0x64, 0x6F, 0x63, 0x69, 0x64}), + + // PowerBASIC Debugger Symbols + (FileType.PDB, new byte[] {0x73, 0x7A, 0x65, 0x7A}), + + // PathWay Map file + (FileType.PRC, new byte[] {0x74, 0x42, 0x4D, 0x50, 0x4B, 0x6E, 0x57, 0x72}), + + // TrueType font + (FileType.TTF, new byte[] {0x74, 0x72, 0x75, 0x65, 0x00}), + + // Tape Archive + (FileType.TAR, new byte[] {0x75, 0x73, 0x74, 0x61, 0x72}), + + // OpenEXR bitmap image + (FileType.EXR, new byte[] {0x76, 0x2F, 0x31, 0x01}), + + // Qimage filter + (FileType.FLT, new byte[] {0x76, 0x32, 0x30, 0x30, 0x33, 0x2E, 0x31, 0x30}), + + // MacOS X image file + (FileType.DMG, new byte[] {0x78, 0x01, 0x73, 0x0D, 0x62, 0x62, 0x60}), + + // eXtensible ARchive file + (FileType.XAR, new byte[] {0x78, 0x61, 0x72, 0x21}), + + // ZoomBrowser Image Index + (FileType.INFO, new byte[] {0x7A, 0x62, 0x65, 0x78}), + + // Windows application log + (FileType.LGC, new byte[] {0x7B, 0x0D, 0x0A, 0x6F, 0x20}), + + // Windows application log + (FileType.LGD, new byte[] {0x7B, 0x0D, 0x0A, 0x6F, 0x20}), + + // MS WinMobile personal note + (FileType.PWI, new byte[] {0x7B, 0x5C, 0x70, 0x77, 0x69}), + + // Rich Text Format + (FileType.RTF, new byte[] {0x7B, 0x5C, 0x72, 0x74, 0x66, 0x31}), + + // Corel Paint Shop Pro image + (FileType.PSP, new byte[] {0x7E, 0x42, 0x4B, 0x00}), + + // Easy Street Draw diagram file + (FileType.ESD, new byte[] {0x7E, 0x45, 0x53, 0x44, 0x77, 0xF6, 0x85, 0x3E, 0xBF, 0x6A, 0xD2, 0x11, 0x45, 0x61, 0x73, 0x79, 0x20, 0x53, 0x74, 0x72, 0x65, 0x65, 0x74, 0x20, 0x44, 0x72, 0x61, 0x77}), + + // Digital Watchdog DW-TP-500G audio + (FileType.IMG, new byte[] {0x7E, 0x74, 0x2C, 0x01, 0x50, 0x70, 0x02, 0x4D, 0x52}), + + // Relocatable object code + (FileType.OBJ, new byte[] {0x80}), + + // Dreamcast audio + (FileType.ADX, new byte[] {0x80, 0x00, 0x00, 0x20, 0x03, 0x12, 0x04}), + + // Kodak Cineon image + (FileType.CIN, new byte[] {0x80, 0x2A, 0x5F, 0xD7}), + + // Outlook Express address book (Win95) + (FileType.WAB, new byte[] {0x81, 0x32, 0x84, 0xC1, 0x85, 0x05, 0xD0, 0x11}), + + // WordPerfect text + (FileType.WPF, new byte[] {0x81, 0xCD, 0xAB}), + + // PNG image + (FileType.PNG, new byte[] {0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A}), + + // MS Answer Wizard + (FileType.AW, new byte[] {0x8A, 0x01, 0x09, 0x00, 0x00, 0x00, 0xE1, 0x08}), + + // Hamarsoft compressed archive + (FileType.HAP, new byte[] {0x91, 0x33, 0x48, 0x46}), + + // PGP secret keyring_1 + (FileType.SKR, new byte[] {0x95, 0x00}), + + // PGP secret keyring_2 + (FileType.SKR, new byte[] {0x95, 0x01}), + + // JBOG2 image file + (FileType.JB2, new byte[] {0x97, 0x4A, 0x42, 0x32, 0x0D, 0x0A, 0x1A, 0x0A}), + + // GPG public keyring + (FileType.GPG, new byte[] {0x99}), + + // PGP public keyring + (FileType.PKR, new byte[] {0x99, 0x01}), + + // Outlook address file + (FileType.WAB, new byte[] {0x9C, 0xCB, 0xCB, 0x8D, 0x13, 0x75, 0xD2, 0x11}), + + // Access Data FTK evidence + (FileType.DAT, new byte[] {0xA9, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}), + + // Quicken data + (FileType.QDF, new byte[] {0xAC, 0x9E, 0xBD, 0x8F, 0x00, 0x00}), + + // PowerPoint presentation subheader_3 + (FileType.PPT, new byte[] {0xA0, 0x46, 0x1D, 0xF0}), + + // BGBlitz position database file + (FileType.PDB, new byte[] {0xAC, 0xED, 0x00, 0x05, 0x73, 0x72, 0x00, 0x12}), + + // Win95 password file + (FileType.PWL, new byte[] {0xB0, 0x4D, 0x46, 0x43}), + + // PCX bitmap + (FileType.DCX, new byte[] {0xB1, 0x68, 0xDE, 0x3A}), + + // Acronis True Image_1 + (FileType.TIB, new byte[] {0xB4, 0x6E, 0x68, 0x44}), + + // Windows calendar + (FileType.CAL, new byte[] {0xB5, 0xA2, 0xB0, 0xB3, 0xB3, 0xB0, 0xA5, 0xB5}), + + // InstallShield Script + (FileType.INS, new byte[] {0xB8, 0xC9, 0x0C, 0x00}), + + // MS Write file_3 + (FileType.WRI, new byte[] {0xBE, 0x00, 0x00, 0x00, 0xAB}), + + // Palm Desktop DateBook + (FileType.DAT, new byte[] {0xBE, 0xBA, 0xFE, 0xCA, 0x0F, 0x50, 0x61, 0x6C, 0x6D, 0x53, 0x47, 0x20, 0x44, 0x61, 0x74, 0x61}), + + // MS Agent Character file + (FileType.ACS, new byte[] {0xC3, 0xAB, 0xCD, 0xAB}), + + // Adobe encapsulated PostScript + (FileType.EPS, new byte[] {0xC5, 0xD0, 0xD3, 0xC6}), + + // Jeppesen FliteLog file + (FileType.LBK, new byte[] {0xC8, 0x00, 0x79, 0x00}), + + // Java bytecode + (FileType.CLASS, new byte[] {0xCA, 0xFE, 0xBA, 0xBE}), + + // Acronis True Image_2 + (FileType.TIB, new byte[] {0xCE, 0x24, 0xB9, 0xA2, 0x20, 0x00, 0x00, 0x00}), + + // Java Cryptography Extension keystore + (FileType.JCEKS, new byte[] {0xCE, 0xCE, 0xCE, 0xCE}), + + // Perfect Office document + (FileType.DOC, new byte[] {0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1, 0x00}), + + // Outlook Express e-mail folder + (FileType.DBX, new byte[] {0xCF, 0xAD, 0x12, 0xFE}), + + // Microsoft Office document + (FileType.DOC, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.DOT, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.PPS, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.PPT, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.XLA, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.XLS, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Office document + (FileType.WIZ, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // CaseWare Working Papers + (FileType.AC_, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Access project file + (FileType.ADP, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Lotus-IBM Approach 97 file + (FileType.APR, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // MSWorks database file + (FileType.DB, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Common Console Document + (FileType.MSC, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Installer package + (FileType.MSI, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Microsoft Installer Patch + (FileType.MSP, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Minitab data file + (FileType.MTW, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // ArcMap GIS project file + (FileType.MXD, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Developer Studio File Options file + (FileType.OPT, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // MS Publisher file + (FileType.PUB, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Revit Project file + (FileType.RVT, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Visual Studio Solution User Options file + (FileType.SOU, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // SPSS output file + (FileType.SPO, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // Visio file + (FileType.VSD, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // MSWorks text document + (FileType.WPS, new byte[] {0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}), + + // WinPharoah filter file + (FileType.FTR, new byte[] {0xD2, 0x0A, 0x00, 0x00}), + + // AOL history|typed URL files + (FileType.ARL, new byte[] {0xD4, 0x2A}), + + // AOL history|typed URL files + (FileType.AUT, new byte[] {0xD4, 0x2A}), + + // Windows graphics metafile + (FileType.WMF, new byte[] {0xD7, 0xCD, 0xC6, 0x9A}), + + // Word 2.0 file + (FileType.DOC, new byte[] {0xDB, 0xA5, 0x2D, 0x00}), + + // Corel color palette + (FileType.CPL, new byte[] {0xDC, 0xDC}), + + // eFax file + (FileType.EFX, new byte[] {0xDC, 0xFE}), + + // Amiga icon + (FileType.INFO, new byte[] {0xE3, 0x10, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00}), + + // Win98 password file + (FileType.PWL, new byte[] {0xE3, 0x82, 0x85, 0x96}), + + // MS OneNote note + (FileType.ONE, new byte[] {0xE4, 0x52, 0x5C, 0x7B, 0x8C, 0xD8, 0xA7, 0x4D}), + + // Windows executable file_1 + (FileType.COM, new byte[] {0xE8}), + + // Windows executable file_1 + (FileType.SYS, new byte[] {0xE8}), + + // Windows executable file_2 + (FileType.COM, new byte[] {0xE9}), + + // Windows executable file_2 + (FileType.SYS, new byte[] {0xE9}), + + // Windows executable file_3 + (FileType.COM, new byte[] {0xEB}), + + // Windows executable file_3 + (FileType.SYS, new byte[] {0xEB}), + + // GEM Raster file + (FileType.IMG, new byte[] {0xEB, 0x3C, 0x90, 0x2A}), + + // Word document subheader + (FileType.DOC, new byte[] {0xEC, 0xA5, 0xC1, 0x00}), + + // RedHat Package Manager + (FileType.RPM, new byte[] {0xED, 0xAB, 0xEE, 0xDB}), + + // Windows Script Component (UTF-8)_1 + (FileType.WSF, new byte[] {0xEF, 0xBB, 0xBF, 0x3C}), + + // Windows Script Component (UTF-8)_2 + (FileType.WSC, new byte[] {0xEF, 0xBB, 0xBF, 0x3C, 0x3F}), + + // Bitcoin-Qt blockchain block file + (FileType.DAT, new byte[] {0xF9, 0xBE, 0xB4, 0xD9}), + + // XZ archive + (FileType.XZ, new byte[] {0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00}), + + // MS Publisher subheader + (FileType.PUB, new byte[] {0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00}), + + // Thumbs.db subheader + (FileType.DB, new byte[] {0xFD, 0xFF, 0xFF, 0xFF}), + + // MS Publisher file subheader + (FileType.PUB, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x02}), + + // Visual Studio Solution subheader + (FileType.SUO, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x04}), + + // PowerPoint presentation subheader_4 + (FileType.PPT, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x0E, 0x00, 0x00, 0x00}), + + // Excel spreadsheet subheader_2 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x10}), + + // PowerPoint presentation subheader_5 + (FileType.PPT, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x1C, 0x00, 0x00, 0x00}), + + // Excel spreadsheet subheader_3 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x1F}), + + // Developer Studio subheader + (FileType.OPT, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x20}), + + // Excel spreadsheet subheader_4 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x22}), + + // Excel spreadsheet subheader_5 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x23}), + + // Excel spreadsheet subheader_6 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x28}), + + // Excel spreadsheet subheader_7 + (FileType.XLS, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x29}), + + // PowerPoint presentation subheader_6 + (FileType.PPT, new byte[] {0xFD, 0xFF, 0xFF, 0xFF, 0x43, 0x00, 0x00, 0x00}), + + // Symantex Ghost image file + (FileType.GHO, new byte[] {0xFE, 0xEF}), + + // Symantex Ghost image file + (FileType.GHS, new byte[] {0xFE, 0xEF}), + + // Windows executable + (FileType.SYS, new byte[] {0xFF}), + + // Works for Windows spreadsheet + (FileType.WKS, new byte[] {0xFF, 0x00, 0x02, 0x00, 0x04, 0x04, 0x05, 0x54}), + + // QuickReport Report + (FileType.QRP, new byte[] {0xFF, 0x0A, 0x00}), + + // Windows international code page + (FileType.CPI, new byte[] {0xFF, 0x46, 0x4F, 0x4E, 0x54}), + + // Keyboard driver file + (FileType.SYS, new byte[] {0xFF, 0x4B, 0x45, 0x59, 0x42, 0x20, 0x20, 0x20}), + + // WordPerfect text and graphics + (FileType.WP, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // WordPerfect text and graphics + (FileType.WPD, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // WordPerfect text and graphics + (FileType.WPG, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // WordPerfect text and graphics + (FileType.WPP, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // WordPerfect text and graphics + (FileType.WP5, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // WordPerfect text and graphics + (FileType.WP6, new byte[] {0xFF, 0x57, 0x50, 0x43}), + + // JPEG-EXIF-SPIFF images + (FileType.JFIF, new byte[] {0xFF, 0xD8, 0xFF}), + + // JPEG-EXIF-SPIFF images + (FileType.JPE, new byte[] {0xFF, 0xD8, 0xFF}), + + // JPEG-EXIF-SPIFF images + (FileType.JPEG, new byte[] {0xFF, 0xD8, 0xFF}), + + // JPEG-EXIF-SPIFF images + (FileType.JPG, new byte[] {0xFF, 0xD8, 0xFF}), + + // MPEG-4 AAC audio + (FileType.AAC, new byte[] {0xFF, 0xF1}), + + // MPEG-2 AAC audio + (FileType.AAC, new byte[] {0xFF, 0xF9}), + + // Windows Registry file + (FileType.REG, new byte[] {0xFF, 0xFE}), + + // MSinfo file + (FileType.MOF, new byte[] {0xFF, 0xFE, 0x23, 0x00, 0x6C, 0x00, 0x69, 0x00}), + + // DOS system driver + (FileType.SYS, new byte[] {0xFF, 0xFF, 0xFF, 0xFF}), + + + };}} \ No newline at end of file diff --git a/Wabbajack.Common/FileSignatures/Signatures.tt b/Wabbajack.Common/FileSignatures/Signatures.tt new file mode 100644 index 00000000..5849108b --- /dev/null +++ b/Wabbajack.Common/FileSignatures/Signatures.tt @@ -0,0 +1,53 @@ +<#@ template language="C#" #> +<#@ assembly name="System.Core" #> +<#@ import namespace="System.Text" #> +<#@ import namespace="System.Collections.Generic" #> +<#@ import namespace="System.IO" #> +<#@ import namespace="System.Linq" #> + +<# + + byte[] StringToByteArray(string hex) { + return Enumerable.Range(0, hex.Length) + .Where(x => x % 2 == 0) + .Select(x => Convert.ToByte(hex.Substring(x, 2), 16)) + .ToArray(); + } + + var files = new string[] {"bsasigs.txt", "file_sigs_RAW.txt"}; + var digits = new HashSet("0123456789".ToArray()); + var rows = files + .SelectMany(file => File.ReadAllLines(Path.Combine("./Definitions/", file))) + .Select(row => row.Split(',')) + .SelectMany(row => row[2].Split('|').Select(e => new + { + EnumName = (digits.Contains(e.First()) ? "_" + e : e).Replace(".", ""), + Sig = row[1].Trim().Split(' ').Select(b => "0x"+b), + Description = row[0] + })); + #> +namespace Wabbajack.Common.FileSignatures { + public static class Definitions { + public enum FileType { <# + + foreach (var nrow in rows.Select(r => r.EnumName).Distinct().OrderBy(r => r)) { + #> + <#= nrow #>, + <#} #> + } + + public static (FileType, byte[])[] Signatures = { + <# + foreach (var row in rows) + { + #> + // <#= row.Description #> + (FileType.<#=row.EnumName #>, new byte[] {<#= string.Join(", ", row.Sig)#>}), + + <# + + } + +#> + + };}} \ No newline at end of file diff --git a/Wabbajack.Common/Paths.cs b/Wabbajack.Common/Paths.cs index 0a808a84..06b66b7f 100644 --- a/Wabbajack.Common/Paths.cs +++ b/Wabbajack.Common/Paths.cs @@ -331,11 +331,11 @@ namespace Wabbajack.Common await fs.WriteAsync(data); } - public async Task WriteAllAsync(Stream data, bool disposeAfter = true) + public async Task WriteAllAsync(Stream data, bool disposeDataAfter = true) { await using var fs = await Create(); await data.CopyToAsync(fs); - if (disposeAfter) await data.DisposeAsync(); + if (disposeDataAfter) await data.DisposeAsync(); } [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Auto)] diff --git a/Wabbajack.Common/Wabbajack.Common.csproj b/Wabbajack.Common/Wabbajack.Common.csproj index 812548c3..ea60d498 100644 --- a/Wabbajack.Common/Wabbajack.Common.csproj +++ b/Wabbajack.Common/Wabbajack.Common.csproj @@ -34,6 +34,10 @@ TextTemplatingFileGenerator PrimitiveHandlers.cs + + TextTemplatingFileGenerator + Signatures.cs + @@ -60,5 +64,10 @@ PrimitiveHandlers.tt + + True + True + Signatures.tt + \ No newline at end of file diff --git a/Wabbajack.Lib/AInstaller.cs b/Wabbajack.Lib/AInstaller.cs index 9c596c87..2a0a2da4 100644 --- a/Wabbajack.Lib/AInstaller.cs +++ b/Wabbajack.Lib/AInstaller.cs @@ -224,6 +224,14 @@ namespace Wabbajack.Lib { Utils.Log($"NOTE: Invalid Hash for {toPatch.To} after patching {hash} vs {toPatch.Hash}"); } + + if (await VirusScanner.ShouldScan(toFile) && + await ClientAPI.GetVirusScanResult(toFile) == VirusScanner.Result.Malware) + { + await toFile.DeleteAsync(); + Utils.ErrorThrow(new Exception($"Virus scan of patched executable reported possible malware: {toFile.ToString()} ({(long)hash})")); + } + }); } diff --git a/Wabbajack.Lib/ClientAPI.cs b/Wabbajack.Lib/ClientAPI.cs index e0cb595e..faa39f37 100644 --- a/Wabbajack.Lib/ClientAPI.cs +++ b/Wabbajack.Lib/ClientAPI.cs @@ -5,7 +5,8 @@ using System.Net; using System.Net.Http; using System.Text; using System.Threading.Tasks; -using Wabbajack.Common; + using Org.BouncyCastle.Crypto.Agreement.Srp; + using Wabbajack.Common; using Wabbajack.Common.Exceptions; using Wabbajack.Common.Serialization.Json; using Wabbajack.Lib.Downloaders; @@ -190,5 +191,33 @@ namespace Wabbajack.Lib var results = await client.GetJsonAsync($"{Consts.WabbajackBuildServerUri}mod_upgrade/find/{src.ToHex()}"); return results; } + + public static async Task GetVirusScanResult(AbsolutePath path) + { + var client = await GetClient(); + Utils.Log($"Checking virus result for {path}"); + + var hash = await path.FileHashAsync(); + + using var result = await client.GetAsync($"{Consts.WabbajackBuildServerUri}virus_scan/{hash.ToHex()}", errorsAsExceptions: false); + if (result.StatusCode == HttpStatusCode.OK) + { + var data = await result.Content.ReadAsStringAsync(); + return Enum.Parse(data); + } + + if (result.StatusCode == HttpStatusCode.NotFound) + { + await using var input = await path.OpenRead(); + using var postResult = await client.PostAsync($"{Consts.WabbajackBuildServerUri}virus_scan", errorsAsExceptions: false, content: new StreamContent(input)); + if (postResult.StatusCode == HttpStatusCode.OK) + { + var data = await postResult.Content.ReadAsStringAsync(); + return Enum.Parse(data); + } + throw new HttpException(result); + } + throw new HttpException(result); + } } } diff --git a/Wabbajack.Lib/CompilationSteps/IncludePatches.cs b/Wabbajack.Lib/CompilationSteps/IncludePatches.cs index 3c32b0bb..eeaddaf0 100644 --- a/Wabbajack.Lib/CompilationSteps/IncludePatches.cs +++ b/Wabbajack.Lib/CompilationSteps/IncludePatches.cs @@ -114,6 +114,14 @@ namespace Wabbajack.Lib.CompilationSteps e.Choices = found; } + if (source.File.IsNative && await VirusScanner.ShouldScan(source.File.AbsoluteName)) + { + if (await ClientAPI.GetVirusScanResult(source.File.AbsoluteName) == VirusScanner.Result.Malware) + { + Utils.ErrorThrow(new Exception($"Executable file {source.File.AbsoluteName} ({source.File}) has been marked as malware.")); + } + } + return e; } diff --git a/Wabbajack.Lib/VirusScanner.cs b/Wabbajack.Lib/VirusScanner.cs new file mode 100644 index 00000000..459f260b --- /dev/null +++ b/Wabbajack.Lib/VirusScanner.cs @@ -0,0 +1,78 @@ +using System.IO; +using System.Linq; +using System.Threading; +using System.Threading.Tasks; +using Org.BouncyCastle.Bcpg; +using Wabbajack.Common; +using Wabbajack.Common.FileSignatures; + +namespace Wabbajack.Lib +{ + /// + /// Wrapper around Windows Defender's commandline tool + /// + public class VirusScanner + { + public enum Result : int + { + NotMalware = 0, + Malware = 2 + } + + private static AbsolutePath ScannerPath() + { + return ((AbsolutePath)@"C:\ProgramData\Microsoft\Windows Defender\Platform") + .EnumerateDirectories(recursive:false) + .OrderByDescending(f => f.FileName) + .First() + .EnumerateFiles(recursive:true) + .First(f => f.FileName == (RelativePath)"MpCmdRun.exe"); + } + + public static async Task<(Hash, Result)> ScanStream(Stream stream) + { + var ms = new MemoryStream(); + await stream.CopyToAsync(ms); + ms.Position = 0; + + var hash = await ms.xxHashAsync(); + ms.Position = 0; + + await using var file = new TempFile(); + try + { + await file.Path.WriteAllAsync(ms); + } + catch (IOException ex) + { + // Was caught before we could fully scan the file due to real-time virus scans + if (ex.Message.ToLowerInvariant().Contains("malware")) + { + return (hash, Result.Malware); + } + } + + var process = new ProcessHelper + { + Path = ScannerPath(), + Arguments = new object[] {"-Scan", "-ScanType", "3", "-DisableRemediation", "-File", file.Path}, + }; + + return (hash, (Result)await process.Start()); + } + + private static SignatureChecker ExecutableChecker = new SignatureChecker(Definitions.FileType.DLL, + Definitions.FileType.EXE, + Definitions.FileType.PIF, + Definitions.FileType.QXD, + Definitions.FileType.QTX, + Definitions.FileType.DRV, + Definitions.FileType.SYS, + Definitions.FileType.COM); + + public static async Task ShouldScan(AbsolutePath path) + { + return await ExecutableChecker.MatchesAsync(path) != null; + } + } +} diff --git a/Wabbajack.Server.Test/VirusCheckTests.cs b/Wabbajack.Server.Test/VirusCheckTests.cs new file mode 100644 index 00000000..8683b119 --- /dev/null +++ b/Wabbajack.Server.Test/VirusCheckTests.cs @@ -0,0 +1,39 @@ +using System.Net; +using System.Threading.Tasks; +using Wabbajack.BuildServer.Test; +using Wabbajack.Common; +using Wabbajack.Lib; +using Xunit; +using Xunit.Abstractions; +using Wabbajack.Common; + +namespace Wabbajack.Server.Test +{ + public class VirusCheckTests : ABuildServerSystemTest + { + public VirusCheckTests(ITestOutputHelper output, SingletonAdaptor fixture) : base(output, fixture) + { + } + + [Fact] + public async Task CheckVirus() + { + var tmpFile = new TempFile(); + + var meta = Game.SkyrimSpecialEdition.MetaData(); + var srcFile = meta.GameLocation().Combine(meta.MainExecutable!); + + await srcFile.CopyToAsync(tmpFile.Path); + + using (var s = await tmpFile.Path.OpenWrite()) + { + s.Position = 1000; + s.WriteByte(42); + } + + Assert.True(await VirusScanner.ShouldScan(tmpFile.Path)); + + Assert.Equal(VirusScanner.Result.NotMalware, await ClientAPI.GetVirusScanResult(tmpFile.Path)); + } + } +} diff --git a/Wabbajack.Server.Test/sql/wabbajack_db.sql b/Wabbajack.Server.Test/sql/wabbajack_db.sql index dd3de1a0..87ec6831 100644 --- a/Wabbajack.Server.Test/sql/wabbajack_db.sql +++ b/Wabbajack.Server.Test/sql/wabbajack_db.sql @@ -641,6 +641,17 @@ CREATE TABLE [dbo].[NexusKeys]( ) ON [PRIMARY] GO +/****** Object: Table [dbo].[VirusScanResults] Script Date: 7/14/2020 9:30:59 PM ******/ +CREATE TABLE [dbo].[VirusScanResults]( + [Hash] [bigint] NOT NULL, + [IsMalware] [tinyint] NOT NULL, + CONSTRAINT [PK_VirusScanResults] PRIMARY KEY CLUSTERED + ( + [Hash] ASC + )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY] +) ON [PRIMARY] +GO + /****** Object: StoredProcedure [dbo].[MergeAllFilesInArchive] Script Date: 3/28/2020 4:58:59 PM ******/ SET ANSI_NULLS ON GO diff --git a/Wabbajack.Server/Controllers/VirusScan.cs b/Wabbajack.Server/Controllers/VirusScan.cs new file mode 100644 index 00000000..7b8878cc --- /dev/null +++ b/Wabbajack.Server/Controllers/VirusScan.cs @@ -0,0 +1,49 @@ +using System.IO; +using System.Threading.Tasks; +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; +using Microsoft.Extensions.Logging; +using Wabbajack.Common; +using Wabbajack.Lib; +using Wabbajack.Server.DataLayer; +using Wabbajack.Server.Services; + +namespace Wabbajack.BuildServer.Controllers +{ + [ApiController] + [Authorize(Roles = "User")] + public class VirusScan : ControllerBase + { + private ILogger _logger; + private SqlService _sql; + + public VirusScan(ILogger logger, SqlService sql) + { + _logger = logger; + _sql = sql; + } + + [HttpPost] + [Route("/virus_scan")] + public async Task CheckFile() + { + var result = await VirusScanner.ScanStream(Request.Body); + await _sql.AddVirusResult(result.Item1, result.Item2); + return Ok(result.Item2.ToString()); + } + + [HttpGet] + [Route("/virus_scan/{hashAsHex}")] + public async Task CheckHash(string hashAsHex) + { + var result = await _sql.FindVirusResult(Hash.FromHex(hashAsHex)); + if (result == null) + { + return NotFound(); + } + + return Ok(result.ToString()); + } + + } +} diff --git a/Wabbajack.Server/DataLayer/VirusScanResults.cs b/Wabbajack.Server/DataLayer/VirusScanResults.cs new file mode 100644 index 00000000..bd23c476 --- /dev/null +++ b/Wabbajack.Server/DataLayer/VirusScanResults.cs @@ -0,0 +1,37 @@ +using System; +using System.Threading.Tasks; +using Dapper; +using Wabbajack.Common; +using Wabbajack.Lib; + +namespace Wabbajack.Server.DataLayer +{ + public partial class SqlService + { + public async Task FindVirusResult(Hash hash) + { + await using var conn = await Open(); + var results = await conn.QueryFirstOrDefaultAsync<(Hash, bool)>( + @"SELECT Hash, IsMalware FROM dbo.VirusScanResults WHERE Hash = @Hash", + new {Hash = hash}); + if (results == default) + return null; + return results.Item2 ? VirusScanner.Result.Malware : VirusScanner.Result.NotMalware; + } + + public async Task AddVirusResult(Hash hash, VirusScanner.Result result) + { + await using var conn = await Open(); + try + { + var results = await conn.QueryFirstOrDefaultAsync<(Hash, bool)>( + @"INSERT INTO dbo.VirusScanResults (Hash, IsMalware) VALUES (@Hash, @IsMalware)", + new {Hash = hash, IsMalware = result == VirusScanner.Result.Malware}); + } + catch (Exception) + { + // ignored + } + } + } +} diff --git a/Wabbajack.VirtualFileSystem/IndexedVirtualFile.cs b/Wabbajack.VirtualFileSystem/IndexedVirtualFile.cs index 33f75214..3755d9c0 100644 --- a/Wabbajack.VirtualFileSystem/IndexedVirtualFile.cs +++ b/Wabbajack.VirtualFileSystem/IndexedVirtualFile.cs @@ -46,11 +46,13 @@ namespace Wabbajack.VirtualFileSystem Size = br.ReadInt64(), }; var lst = new List(); + ivf.Children = lst; var count = br.ReadInt32(); for (int x = 0; x < count; x++) { lst.Add(Read(br)); } + return ivf; }