### Home Classes Methods

### Files

- Makefile
- AUTHORS
- COPYING
- ChangeLog
- INSTALL
- MAINT
- Makefile
- NEWS
- README
- TODO
- compile
- configure
- depcomp
- Makefile
- install-sh
- libtool
- Header
- Localstuff
- acorn
- adi
- adventure
- allegro
- alliant
- amanda
- amigaos
- animation
- apl
- apple
- applix
- archive
- asterix
- att3b
- audio
- basis
- bflt
- blcr
- blender
- blit
- bout
- bsdi
- bsi
- btsnoop
- c-lang
- c64
- cad
- cafebabe
- cddb
- chord
- cisco
- citrus
- clarion
- claris
- clipper
- commands
- communications
- compress
- console
- convex
- cracklib
- ctags
- dact
- database
- diamond
- diff
- digital
- dolby
- dump
- dyadic
- ebml
- editors
- efi
- elf
- encore
- epoc
- erlang
- esri
- fcs
- filesystems
- flash
- fonts
- fortran
- frame
- freebsd
- fsav
- games
- gcc
- geo
- geos
- gimp
- gnome-keyring
- gnu
- gnumeric
- grace
- graphviz
- gringotts
- hitachi-sh
- hp
- human68k
- ibm370
- ibm6000
- iff
- images
- inform
- intel
- interleaf
- island
- ispell
- isz
- java
- jpeg
- karma
- kde
- kml
- lecter
- lex
- lif
- linux
- lisp
- llvm
- lua
- luks
- mach
- macintosh
- magic
- maple
- mathcad
- mathematica
- matroska
- mcrypt
- mercurial
- metastore
- mime
- mips
- mirage
- misctools
- mkid
- mlssa
- mmdf
- modem
- motorola
- mozilla
- msdos
- msooxml
- msvc
- mup
- natinst
- ncr
- netbsd
- netscape
- netware
- news
- nitpicker
- oasis
- ocaml
- octave
- ole2compounddocs
- olf
- os2
- os400
- os9
- osf1
- palm
- parix
- parrot
- pbm
- pdf
- pdp
- perl
- pgp
- pkgadd
- plan9
- plus5
- printer
- project
- psdbms
- pulsar
- pyramid
- python
- revision
- riff
- rinex
- rpm
- rtf
- ruby
- sc
- sccs
- scientific
- securitycerts
- selinux
- sendmail
- sequent
- sgi
- sgml
- sharc
- sinclair
- sisu
- sketch
- smalltalk
- sniffer
- softquad
- spec
- spectrum
- sql
- ssh
- ssl
- sun
- sysex
- tcl
- teapot
- terminfo
- tex
- tgif
- ti-8x
- timezone
- troff
- tuxedo
- typeset
- unicode
- unknown
- uuencode
- vax
- vicar
- virtual
- virtutech
- visx
- vms
- vmware
- vorbis
- vxl
- warc
- weak
- windows
- wireless
- wordprocessors
- wsdl
- xdelta
- xenix
- xilinx
- xo65
- xwindows
- zilog
- zyxel
- Makefile
- missing
- Makefile
- README
- Makefile
- stamp-h1
- Makefile
- README

### Class Index

Quicksearch

- CharlockHolmes
- CharlockHolmes::Converter
- CharlockHolmes::EncodingDetector
- Object
- String

No matching classes.

#------------------------------------------------------------------------------ # $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $ # windows: file(1) magic for Microsoft Windows # # This file is mainly reserved for files where programs # using them are run almost always on MS Windows 3.x or # above, or files only used exclusively in Windows OS, # where there is no better category to allocate for. # For example, even though WinZIP almost run on Windows # only, it is better to treat them as "archive" instead. # For format usable in DOS, such as generic executable # format, please specify under "msdos" file. #

# Summary: Outlook Express DBX file # Extension: .dbx # Created by: Christophe Monniez 0 string xCFxADx12xFE MS Outlook Express DBX file >4 byte =0xC5 b, message database >4 byte =0xC6 b, folder database >4 byte =0xC7 b, account information >4 byte =0x30 b, offline database

# Summary: Windows crash dump # Extension: .dmp # Created by: Andreas Schuster (computer.forensikblog.de/) # Reference (1): computer.forensikblog.de/en/2008/02/64bit_magic.html # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 0 string PAGE >4 string DUMP MS Windows 32bit crash dump >>0x05c byte 0 b, no PAE >>0x05c byte 1 b, PAE >>0xf88 lelong 1 b, full dump >>0xf88 lelong 2 b, kernel dump >>0xf88 lelong 3 b, small dump >>0x068 lelong x b, %ld pages >4 string DU64 MS Windows 64bit crash dump >>0xf98 lelong 1 b, full dump >>0xf98 lelong 2 b, kernel dump >>0xf98 lelong 3 b, small dump >>0x090 lequad x b, %lld pages

# Summary: Vista Event Log # Extension: .evtx # Created by: Andreas Schuster (computer.forensikblog.de/) # Reference (1): computer.forensikblog.de/en/2007/05/some_magic.html 0 string ElfFile0 MS Windows Vista Event Log >0x2a leshort x b, %d chunks >>0x10 lelong x b (no. %d in use) >0x18 lelong >1 b, next record no. %d >0x18 lelong =1 b, empty >0x78 lelong &1 b, DIRTY >0x78 lelong &2 b, FULL

# Summary: Windows 3.1 group files # Extension: .grp # Created by: unknown 0 string 120115103103 MS Windows 3.1 group files

# Summary: Old format help files # Extension: .hlp # Created by: Dirk Jagdmann <doj@cubic.org> 0 lelong 0x00035f3f MS Windows 3.x help file

# Summary: Hyper terminal # Extension: .ht # Created by: unknown 0 string HyperTerminal\ >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile

# Summary: Windows shortcut # Extension: .lnk # Created by: unknown 0 string 11400000102400200000300000000106 MS Windows shortcut

# Summary: Outlook Personal Folders # Created by: unknown 0 lelong 0x4E444221 Microsoft Outlook email folder >10 leshort 0x0e (<=2002) >10 leshort 0x17 (>=2003)

# Summary: Windows help cache # Created by: unknown 0 string 164146115122012000000000001000000000 MS Windows help cache

# Summary: IE cache file # Created by: Christophe Monniez 0 string Client\ UrlCache\ MMF Internet Explorer cache file >20 string >0 version %s

# Summary: Registry files # Created by: unknown # Modified by (1): Joerg Jenderek 0 string regf MS Windows registry file, NT/2000 or above 0 string CREG MS Windows 95/98/ME registry file 0 string SHCC3 MS Windows 3.1 registry file

# Summary: Windows Registry text # Extension: .reg # Submitted by: Abel Cheung <abelcheung@gmail.com> 0 string REGEDIT4rnrn Windows Registry text (Win95 or above) 0 string Windows\ Registry\ Editor\ >&0 string Version\ 5.00rnrn Windows Registry text (Win2K or above)

# From: Pal Tamas <folti@balabit.hu> # Autorun File 0 string/c [autorun]rn Microsoft Windows Autorun file. !:mime application/x-setupscript.

[Validate]

Generated with the Darkfish Rdoc Generator 2.