No Extension? No Problem: How to Identify Almost Any File Type

Let’s get a little geeky.

Got a mystery file with no extension or an ambiguous one? You may be able to uncover what it is by checking its signature. I’ll show you how to peek inside with a free tool and match the clues to known formats.
Identifying the first two bytes in a file using HxD.
Identifying the first two bytes in a file using HxD. (Screenshot: askleo.com)
Question: I downloaded a few video files without extensions. I tried inserting all of the common extensions, but none of them would play. Is there a way to determine which format the files are in?

For video files, my gut answer is to say, “I don’t know”. Video file formats are a complex maze of twisty passages.

But we can get a few clues — not only about your video files, but about other types of files as well.

TL;DR:

What kind of file is that?

You can figure out a file’s type by looking at its “signature” — the first few bytes of a file, which identify it. Use a hex editor like HxD to see those bytes and then match them to a file signature list. It’s not foolproof, but it can give strong clues.

File signatures

Many — though certainly not all — files begin with a series of fixed values that identify the type of file they are. This is referred to as a file’s “signature”, or sometimes its “magic number”.

A great example is the .exe file. All .exe files begin with two bytes: 4D and 5A. That’s the hexadecimal (or just hex) value for the uppercase letters MZ, which are the initials of the Microsoft engineer who defined the original file format1. If the first two bytes of a file are MZ, then you’re looking at an .exe file or one of its derivatives, like a .dll file.

The approach is to examine the first few bytes of a file and then use what we find there to see if we can determine the file format.

Ask Leo! is temporarily Ad-Free!
Help make it permanent by becoming a Patron.

Examining the file

The MZ example happens to use printable characters. If you open an .exe file in Notepad, you’ll see MZ at the beginning. But signatures aren’t always printable characters.

That means we need to look at the contents of the file in hexadecimal. The tool I use is the freeware HxD.

Caution: HxD is a Hex editor, meaning you can modify files with it. Be careful not to accidentally make changes. You could corrupt files, your system, and/or your hard drive by modifying the wrong things. Fortunately, HxD makes it obvious that you’re changing things by displaying changes in red, and it includes proper confirmations and backup files by default.

Let’s say that we’re looking at a file called “example.foo”. The image at the top of the page shows it open in HxD.

Here, we can see that the file begins with the hex character values 3F, 5F, 03, 00, 00, and so on. The first two happen to be values for the question mark character and the underscore character. We don’t yet know if that’s intentional, but it doesn’t matter. What we care about are the values in hexadecimal.

Finding the signature

There’s no definitive list of file signatures, but the Wikipedia page List of file signatures is pretty good.

We simply scan down the table to look for an entry that begins with the first character: 3F.

.hlp file signature
The file in question is an .hlp file signature. Click for larger image. (Screenshot: askleo.com)

In fact, there’s only one. As you can see, files that begin with the characters 3F and 5F are typically associated with the old Windows Help utility. I can confirm that because I was on that Microsoft team. 3F, 5F represents a question mark and underscore (?_), and that’s not a coincidence.2

Signature confusion

As if the hexadecimal search and display weren’t geeky enough, I have to caution you to take care when scanning the table of signatures for matches. Make sure that what you have matches what you see; if there is more than one possibility, choose the longest candidate that matches.

The file format you need may not be there.3 I haven’t found an exhaustive list.

The file format you need might be ambiguous. Several signatures list more than one application. Perhaps the additional knowledge you have of where the file came from will help distinguish among the possibilities.

Knowing the file format might not be enough. .AVI files are a great example; they’re container files that can contain audio and video in many encodings.

Do this

Much of this is idle and even historical curiosity. However, if you come across a file that you’re trying to identify, you’re now armed with additional information. Hopefully, you’ll be able to gather some additional clues about what kind of file you have.

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

Podcast audio

Play

Footnotes & References

1: And, coincidentally, the first person to interview me when I applied to Microsoft.

2: They were a crude attempt to mimic the WinHelp program’s icon: a question mark and its shadow. Very old WinHelp icon.

3: My personal favorite, 4C 4E, is not listed. That’s LN, the signature for the character-mode help files I created in the days before Windows.

4 comments on “No Extension? No Problem: How to Identify Almost Any File Type”

  1. This also helps to explain why it’s called a signature. It’s literally the creator’s signature (initials), at least in some cases.

    Reply
    • Yes, Zip files have a PK signature for Phil Katz. And .docx and other MS-Office files begin with PK because they are actually contained in a ZIP file. If you change the extension of an office file to .zip it will be opened as a .zip file and you can see the different files that are inside.

      Reply
  2. Leo, you wrote:

    Caution: HxD is a Hex editor, meaning you can modify files with it. Be careful not to accidentally make changes. You could corrupt files, your system, and/or your hard drive by modifying the wrong things.”

    However, and that being said, provided that you are very careful (and better still if you know what the H*** you’re doing), it is quite possible to do some very geeky things by carefully and deliberately changing (i.e., “tweaking”) certain files.

    Just as one example, I remember that, under Windows XP Pro, I was able to change the word “Start” (on the Start button) to say “WinXP”! 😮

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.