Dateisignaturen

Dateisignaturen are fixed byte sequences at the beginning of a file that identify its format. They are also known as magic numbers and are used by software to determine the true type of a file regardless of its extension. Dateisignaturen are stored in the file header and are essential for media players, editors, operating systems, antivirus programs, forensic tools, and data recovery utilities.

How they work: A program reads the initial bytes of a file and compares them against a database of signatures. If a match is found, the corresponding file type is inferred. Some formats have multiple valid signatures or variants, and some signatures appear only in combination with additional header data. Signatures do not guarantee correctness in all cases; mislabeling or file corruption can obscure or alter signatures.

Common examples:

- PDF: ASCII "%PDF-" (hex 25 50 44 46 2D)

- PNG: 89 50 4E 47 0D 0A 1A 0A

- JPEG: FF D8 FF (often followed by E0/E1, etc.)

- GIF: "GIF87a" or "GIF89a" (hex 47 49 46 38 37 61 or 47 49 46 38 39 61)

- TIFF: II 2A 00 or MM 42 4D 00 2A

- ZIP: PK 03 04 (hex 50 4B 03 04)

- RAR: 52 61 72 21 1A 07 00

- WAV: "RIFF" 52 49 46 46 and "WAVE" 57 41 56 45

- ELF: 7F 45 4C 46

- MZ/EXE: 4D 5A (ASCII "MZ")

Limitations: Signatures can be spoofed, missing, or present in containers that house multiple formats. Some files rely on embedded or complex structures, making detection more challenging. Tooling such as the Unix file command (libmagic) relies on comprehensive signature databases to identify file types.