magic/Magdir/ole2compounddocs

   1
   2 #------------------------------------------------------------------------------
   3 # $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $
   4 # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
   5 # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
   6 # Additional tests for OLE 2 Compound Documents should be under this recipe.
   7 # reference:    https://www.openoffice.org/sc/compdocfileformat.pdf
   8
   9 0   string  \320\317\021\340\241\261\032\341
  10 # https://digital-preservation.github.io/droid/
  11 # skip droid skeleton like fmt-39-signature-id-128.doc by valid version
  12 >0x1A   ushort          !0xABAB         OLE 2 Compound Document
  13 #>0x1C  uleshort                x                       \b, endnian %#4.4x
  14 # big endian not tested
  15 >>0x1C  ubeshort                =0xfffe                 \b, big-endian
  16 >>>546  string  jbjb                    : Microsoft Word Document
  17 !:mime  application/msword
  18 !:apple MSWDWDBN
  19 !:ext   doc
  20 # Byte Order 0xFFFE means little-endian found in real world applications
  21 #>>0x1C uleshort                =0xfffe                 \b, little-endian
  22 >>0x1C  uleshort                =0xfffe
  23 # From:         Joerg Jenderek
  24 # Major Version 3 or 4
  25 >>>0x1A uleshort                x                       \b, v%u
  26 # Minor Version 32h=50 3Bh=59 3Eh=62
  27 >>>0x18 uleshort                x                       \b.%u
  28 # SecID of first sector of the directory stream is often 1 but high like 3144h
  29 >>>48   ulelong                 x                       \b, SecID %#x
  30 # Sector Shift Exponent in short-stream container stream: 6~64 bytes
  31 >>>32   uleshort                !6                      \b, exponent of short stream %u
  32 # total number of sectors used for the FAT
  33 >>>44   ulelong                 >1                      \b, %u FAT sectors
  34 # SecID of first sector of the short-sector allocation table (Mini FAT)
  35 # or -2 (End Of ChainSecID) if not extant
  36 >>>60   ulelong                 !0xffFFffFE             \b, Mini FAT start sector %#x
  37 # total number of sectors used for the short-sector allocation table
  38 >>>64   ulelong                 !1                      \b, %u Mini FAT sector
  39 # plural s
  40 >>>>64  ulelong                 >1                      \bs
  41 # SecID of first sector of the master sector allocation table (DIFAT)
  42 # or -2 (End Of Chain SecID) if no additional sectors used
  43 >>>68   ulelong                 !0xffFFffFE             \b, DIFAT start sector %#x
  44 # total number of sectors used for the master sector allocation table (DIFAT)
  45 >>>72   ulelong                 >0                      \b, %u DIFAT sectors
  46 # First part of the master sector allocation table (DIFAT) containing 109 SecIDs
  47 #>>>76  ubequad                 x                       \b, DIFAT=%#16.16llx
  48 #>>>84  ubequad                 x                       \b%16.16llx...
  49 # pointer to root entry only works with standard configuration for SecID ~< 800h
  50 # Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
  51 # "ORLEN Factbook 2017.xls" XnView_metadata.doc
  52 # "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
  53 >>>48   ulelong                 >0x800                  too big for FILE_BYTES_MAX = 1 MiB
  54 # Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
  55 >>>0x1E uleshort                0xc                     \b, blocksize 4096
  56 # jump to one block (4096 bytes per block) before root storage block
  57 >>>>(48.l*4096) ubyte   x
  58 >>>>>&4095      use             ole2-directory
  59 #>>>0x1E        uleshort                9                       \b, blocksize 512
  60 >>>0x1E uleshort                9
  61 # jump to one block (512 bytes per block) before root storage block
  62 # in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
  63 >>>>(48.l*512)  ubyte           x
  64 >>>>>&511       use             ole2-directory
  65 # check directory entry structure and display types by GUID
  66 0       name                    ole2-directory
  67 # directory entry name like "Root Entry"
  68 #>0     lestring16      x                       \b, 1st %.10s
  69 # type of the entry; 5~Root storage
  70 #>66    ubyte           x                       \b, type %x
  71 # node colour of the entry: 00H ~ Red 01H ~ Black
  72 #>67    ubyte           x                       \b, color %x
  73 # the DirIDs of the child nodes. Should both be -1 in the root storage entry
  74 #>68    bequad          !0xffffffffffffffff     \b, DirIDs %llx
  75 # NEXT lines for DEBUGGING
  76 # second directory entry name like VisioDocument Control000
  77 #>128   lestring16      x \b, 2nd %.20s
  78 # third directory entry like WordDocument
  79 #>256   lestring16      x \b, 3rd %.20s
  80 # forth
  81 #>384   lestring16      x \b, 4th %.10s
  82 # 5th
  83 #>512   lestring16      x \b, 5th %.10s
  84 # 6th
  85 #>640   lestring16      x \b, 6th %.10s
  86 # 7th
  87 #>768   lestring16      x \b, 7th %.10s
  88 #       https://wikileaks.org/ciav7p1/cms/page_13762814.html
  89 #       https://m.blog.naver.com/superman4u/40047693679
  90 #       https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
  91 #       https://toolslick.com/conversion/data/guid
  92 #>80    ubequad         !0                      \b, clsid %#16.16llx
  93 #>>88   ubequad         x                       \b%16.16llx
  94 # test for "Root Entry" inside directory by type 5 value
  95 >66     ubyte           5
  96 # look for CLSID GUID 0
  97 >>88    ubequad         0x0
  98 >>>80   ubequad         0x0
  99 # - Microstation V8 DGN files (www.bentley.com)
 100 # URL:  https://en.wikipedia.org/wiki/MicroStation
 101 #   Last update on 10/23/2006 by Lester Hightower
 102 #   07/24/2019 by Joerg Jenderek
 103 # Second directory entry name like Dgn~H Dgn~S
 104 >>>>128         lestring16      Dgn~                    : Microstation V8 CAD
 105 #!:mime application/x-ole-storage
 106 !:mime  application/x-bentley-dgn
 107 # http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
 108 !:ext   dgn
 109 #
 110 # URL:  http://fileformats.archiveteam.org/wiki/WordPerfect
 111 # Second directory entry name PerfectOffice_
 112 >>>>128         lestring16      PerfectOffice_          : WordPerfect 7-X3 presentations Master, Document or Graphic
 113 !:mime  application/vnd.wordperfect
 114 # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
 115 !:apple ????WPC7
 116 !:ext   mst/wpd/wpg
 117 #
 118 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 119 # Second directory entry name MatOST_
 120 >>>>128         lestring16      MatOST                  : Microsoft Works 3.0 document
 121 !:mime  application/vnd.ms-works
 122 !:apple ????AWWP
 123 !:ext   wps
 124 #
 125 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
 126 # 3rd directory entry name WksSSWorkBook
 127 >>>>256         lestring16      WksSSWorkBook           : Microsoft Works 6-9 spreadsheet
 128 !:mime  application/vnd.ms-works
 129 !:apple ????AWSS
 130 !:ext   xlr
 131 #
 132 # URL:  http://fileformats.archiveteam.org/wiki/XLS
 133 # what is the difference to {00020820-0000-0000-c000-000000000046} ?
 134 # Second directory entry name Workbook
 135 >>>>128         lestring16      Workbook
 136 >>>>>256        lestring16      !WksSSWorkBook          : Microsoft Excel 97-2003 worksheet 0 clsid
 137 !:mime  application/vnd.ms-excel
 138 # https://www.macdisk.com/macsigen.php  XLS5 for Excel 5
 139 !:apple ????XLS9
 140 !:ext   xls
 141 #
 142 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 143 # Second directory entry name Object1 Object12 Object35
 144 >>>>128         lestring16      Object                  : Microsoft PowerPoint 4 presentation
 145 !:mime  application/vnd.ms-powerpoint
 146 # https://www.macdisk.com/macsigen.php
 147 !:apple ????PPT3
 148 !:ext   ppt
 149 #
 150 # URL:  https://www.msoutlook.info/question/164
 151 # Second directory entry name __CollDataStm
 152 >>>>128         lestring16      __CollDataStm           : Microsoft Outlook Send Receive Settings
 153 #!:mime application/vnd.ms-outlook
 154 !:mime  application/x-ms-srs
 155 # %APPDATA%\Microsoft\Outlook\Outlook.srs
 156 !:ext   srs
 157 #
 158 # URL:  https://www.file-extensions.org/cag-file-extension
 159 # Second directory entry name Category
 160 >>>>128         lestring16      Category                : Microsoft Clip Art Gallery
 161 #!:mime application/x-ole-storage
 162 !:mime  application/x-ms-cag
 163 !:apple MScgCGdb
 164 !:ext   cag/
 165 #
 166 # URL:  https://www.filesuffix.com/de/extension/rra
 167 # 3rd directory entry name StrIndex_StringTable
 168 >>>>256         lestring16      StrIndex_StringTable    : Windows temporarily installer
 169 #!:mime application/x-ole-storage
 170 !:mime  application/x-ms-rra
 171 !:ext   rra
 172 #
 173 # URL:  https://www.forensicswiki.org/wiki/Jump_Lists
 174 # 3rd directory entry name DestList
 175 >>>>256         lestring16      DestList                : Windows jump list
 176 #!:mime application/x-ole-storage
 177 !:mime  application/x-ms-jumplist
 178 # %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
 179 !:ext   automaticDestinations-ms
 180 #
 181 # URL:  https://en.wikipedia.org/wiki/Windows_thumbnail_cache
 182 # Second directory entry name 256_
 183 >>>>128         lestring16      256_                    : Windows thumbnail database 256
 184 #!:mime application/x-ole-storage
 185 !:mime  application/x-ms-thumbnail
 186 # Thumbs.db
 187 !:ext   db
 188 >>>>128         lestring16      96_                     : Windows thumbnail database 96
 189 !:mime  application/x-ms-thumbnail
 190 !:ext   db
 191 # 3rd directory entry name Catalog_
 192 >>>>256         lestring16      Catalog                 : Windows thumbnail database
 193 !:mime  application/x-ms-thumbnail
 194 !:ext   db
 195 #
 196 # URL:  https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
 197 # Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
 198 # Second directory entry name Control000
 199 >>>>128         lestring16      Control000              : Microsoft old Systeminfo
 200 #!:mime application/x-ole-storage
 201 !:mime  application/x-ms-info
 202 !:ext   nfo
 203 #
 204 # From:         Joerg Jenderek
 205 # URL:          https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
 206 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml
 207 # Note:         older versions til 13 about middle 2021 handled by ./windows
 208 #               called "Sysinternals Autoruns data (v14)" by TrID
 209 # second, third and fourth directory entry name like Header Items 0
 210 >>>>128         lestring16      Header          : Microsoft sysinternals AutoRuns data, version 14
 211 #!:mime application/x-ole-storage
 212 !:mime          application/x-ms-arn
 213 # like: MyHOSTNAME.arn
 214 !:ext           arn
 215 #
 216 # From:         Joerg Jenderek
 217 # URL:          https://en.wikipedia.org/wiki/Microsoft_Access
 218 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
 219 #               http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 220 # Note:         only version foo tested and called "Microsoft Access Wizard template" by TrID
 221 # Fourth directory entry name TemplateID
 222 >>>>384         lestring16      TemplateID              : Microsoft Access wizard template
 223 # Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation
 224 #!:mime application/x-ole-storage
 225 #!:mime application/vnd.ms-office
 226 #!:mime application/vnd.ms-access
 227 #!:mime application/msaccess
 228 !:mime  application/x-ms-mdz
 229 # http://extension.nirsoft.net/mdz
 230 !:ext   mdz
 231 #
 232 # URL:  http://fileformats.archiveteam.org/wiki/Corel_Print_House
 233 # Second directory entry name Thumbnail
 234 >>>>128         lestring16      Thumbnail               : Corel PrintHouse image
 235 #!:mime application/x-ole-storage
 236 !:mime  application/x-corel-cph
 237 !:ext   cph
 238 # 3rd directory entry name Thumbnail
 239 >>>>256         lestring16      Thumbnail               : Corel PrintHouse image
 240 !:mime  application/x-corel-cph
 241 !:ext   cph
 242 # URL:  http://fileformats.archiveteam.org/wiki/Corel_Gallery
 243 # Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
 244 # third directory entry name _INFO_
 245 >>>>256         lestring16      _INFO_                  : Corel Gallery
 246 # second directory entry name _ITEM_ or _DATA_
 247 # later directory entry names: _ALBUM_ _THUMBNAIL_
 248 #!:mime application/x-ole-storage
 249 !:mime  application/x-corel-gal
 250 !:ext   gal
 251 #
 252 # From:         Joerg Jenderek
 253 # URL:          https://archive.org/details/iPhoto-Plus-4
 254 #               https://filext.com/file-extension/TPL
 255 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml
 256 # Note:         found in Template sub directory in program directory of software iPhoto Plus version 4
 257 # second, third and fourth directory entry name like TplHeader TplMainImage TplPreview
 258 >>>>128         lestring16      TplHeader               : Ulead iPhoto Template
 259 #!:mime application/x-ole-storage
 260 !:mime  image/x-ulead-tpl
 261 # https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template
 262 !:ext   tpl
 263 #
 264 # URL:  https://en.wikipedia.org/wiki/Hangul_(word_processor)
 265 #       https://www.hancom.com/etc/hwpDownload.do
 266 # Note: "HWP Document File" signature found in FileHeader
 267 # Hangul Word Processor WORDIAN, 2002 and later is using HWP 5.0 format.
 268 # Second directory entry name FileHeader hint for Thinkfree Office document
 269 >>>>128         lestring16      FileHeader              : Hancom HWP (Hangul Word Processor) file, version 5.0
 270 #!:mime application/haansofthwp
 271 !:mime  application/x-hwp
 272 # https://example-files.online-convert.com/document/hwp/example.hwp
 273 !:ext   hwp
 274 #
 275 # URL:  https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
 276 # Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
 277 >>>>128         lestring16      dd2                     : StarOffice Gallery view
 278 #!:mime application/x-ole-storage
 279 !:mime  application/x-star-sdv
 280 !:ext   sdv
 281 # URL:  https://en.wikipedia.org/wiki/SoftMaker_Office
 282 # second directory entry name Current User
 283 >>>>128         lestring16      Current\ User           : SoftMaker
 284 # third directory entry name SMNativeObjData
 285 >>>>>256        lestring16      SMNativeObjData
 286 # 5th directory entry name PowerPoint
 287 >>>>>>512       lestring16      PowerPoint              PowerPoint presentation or template
 288 !:mime  application/vnd.ms-powerpoint
 289 !:ext   ppt/pps/pot
 290 # 4th directory entry name PowerPoint
 291 >>>>>384        lestring16      PowerPoint              Presentations or template
 292 # http://extension.nirsoft.net/prv
 293 !:mime  application/vnd.softmaker.presentations
 294 !:ext   prd/prv
 295 # third directory entry name like Current User
 296 >>>>256         lestring16      Current\ User           : SoftMaker
 297 # 5th directory entry name PowerPoint
 298 >>>>>512        lestring16      PowerPoint              Presentations or template
 299 # http://extension.nirsoft.net/prd
 300 !:mime  application/vnd.softmaker.presentations
 301 !:ext   prd/prv
 302 # 2nd directory entry name Pictures
 303 >>>>>>128       lestring16      Pictures                with pictures
 304 #
 305 # URL:          http://fileformats.archiveteam.org/wiki/PageMaker
 306 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/p
 307 #               pagemaker-generic.trid.xml
 308 #               pagemaker-pm6.trid.xml
 309 #               pagemaker-pm65.trid.xml
 310 #               pmd-pm7.trid.xml
 311 # From:         Joerg Jenderek
 312 # Note:         since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors
 313 #               verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6`
 314 # Second directory entry name PageMaker
 315 >>>>128         lestring16      PageMaker               :
 316 # look for magic of "old" PageMaker like in 02TEMPLT.T65
 317 >>>>>0  search/0xa900/s \0\0\0\0\0\0\xff\x99
 318 # GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version!
 319 #>>>>>>&0       use             PageMaker
 320 # THIS WORKS PARTLY!
 321 >>>>>>&0        indirect        x
 322 #       remaining null clsid
 323 >>>>128         default         x
 324 >>>>>0  use             ole2-unknown
 325 # look for CLSID where "second" part is 0
 326 >>>80   ubequad         !0x0
 327 #
 328 # Summary:      Family Tree Maker
 329 # From:         Joerg Jenderek
 330 # URL:          http://fileformats.archiveteam.org/wiki/Family_Tree_Maker
 331 #               https://en.wikipedia.org/wiki/Family_Tree_Maker
 332 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/f/ftw.trid.xml
 333 # Note          called "Family Tree Maker Family Tree" by TrID and
 334 #               "FamilyTree Maker Database" with version "1-4" by DROID via PUID fmt/1352
 335 #               tested only with version 2.0
 336 #               verified by Michal Mutl Structured Storage Viewer `SSView.exe my.ftw`
 337 #               newer versions are SQLite based and handled by ./sql
 338 # directory names like: IND.DB AUX.DB GENERAL.DB NAME.NDX BIRTH.NDX EXTRA.DB
 339 >>>>80  ubequad         0x5702000000000000      : Family Tree Maker Windows database, version 1-4
 340 # look for "File Format (C) Copyright 1993 Banner Blue Software Inc. - All Rights Reserved" in GENERAL.DB
 341 #>>>>>0 search/0x5460c/s        F\0i\0l\0e\0\040\0F\0o\0r\0m\0a\0t\0\040\0(\0C\0)\0     \b, VERSION
 342 # GRR: jump to version value like 2 does not work!
 343 #>>>>>>&-8      ubyte           x                                                       %u
 344 #!:mime application/x-ole-storage
 345 !:mime  application/x-fmt
 346 # FBK is used for backup of FTW
 347 !:ext   ftw/fbk
 348 #
 349 >>>>80  default         x
 350 >>>>>0  use             ole2-unknown
 351 #       look for known clsid GUID
 352 # - Visio documents
 353 # URL:  http://fileformats.archiveteam.org/wiki/Visio
 354 #   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
 355 >>88    ubequad         0xc000000000000046
 356 >>>80   ubequad         0x131a020000000000      : Microsoft Visio 2000-2002 Document, stencil or template
 357 !:mime  application/vnd.visio
 358 # VSD~Drawing VSS~Stencil VST~Template
 359 !:ext   vsd/vss/vst
 360 >>>80   ubequad         0x141a020000000000      : Microsoft Visio 2003-2010 Document, stencil or template
 361 !:mime  application/vnd.visio
 362 !:ext   vsd/vss/vst
 363 #
 364 # URL:  http://fileformats.archiveteam.org/wiki/Windows_Installer
 365 #       https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation
 366 # Update: Joerg Jenderek
 367 # Windows Installer Package *.MSI or validation module *.CUB
 368 >>>80   ubequad         0x84100c0000000000      : Microsoft Windows Installer Package or validation module
 369 !:mime  application/x-msi
 370 #!:mime application/x-ms-win-installer
 371 #       https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices
 372 # cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub
 373 #!:mime application/x-ms-cub
 374 !:ext   msi/cub
 375 # From:         Joerg Jenderek
 376 # URL:          http://en.wikipedia.org/wiki/Windows_Installer
 377 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/m/mst.trid.xml
 378 #               called "Windows SDK Setup Transform script" by TrID
 379 >>>80   ubequad         0x82100c0000000000      : Microsoft Windows Installer transform script
 380 #!:mime application/x-ole-storage
 381 !:mime  application/x-ms-mst
 382 !:ext   mst
 383 >>>80   ubequad         0x86100c0000000000      : Microsoft Windows Installer Patch
 384 # ??
 385 !:mime  application/x-wine-extension-msp
 386 #!:mime application/x-ms-msp
 387 !:ext   msp
 388 #
 389 # URL:  http://fileformats.archiveteam.org/wiki/DOC
 390 >>>80   ubequad         0x0009020000000000      : Microsoft Word 6-95 document or template
 391 !:mime  application/msword
 392 # for template MSWDW8TN
 393 !:apple MSWDWDBN
 394 !:ext   doc/dot
 395 >>>80   ubequad         0x0609020000000000      : Microsoft Word 97-2003 document or template
 396 !:mime  application/msword
 397 !:apple MSWDWDBN
 398 # dot for template; no extension on Macintosh
 399 !:ext   doc/dot/
 400 #
 401 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 402 >>>80   ubequad         0x0213020000000000      : Microsoft Works 3-4 document or template
 403 !:mime  application/vnd.ms-works
 404 !:apple ????AWWP
 405 # ps for template       https://filext.com/file-extension/PS    bps for backup
 406 !:ext   wps/ps/bps
 407 #
 408 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
 409 >>>80   ubequad         0x0313020000000000      : Microsoft Works 3-4 database or template
 410 !:mime  application/vnd.ms-works-db
 411 # https://www.macdisk.com/macsigen.php
 412 !:apple ????AWDB
 413 # db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
 414 !:ext   wdb/db/bdb
 415 #
 416 # URL:  https://en.wikipedia.org/wiki/Microsoft_Excel
 417 >>>80   ubequad         0x1008020000000000      : Microsoft Excel 5-95 worksheet, addin or template
 418 !:mime  application/vnd.ms-excel
 419 # https://www.macdisk.com/macsigen.php
 420 !:apple ????XLS5
 421 # worksheet/addin/template/no extension on Macintosh
 422 !:ext   xls/xla/xlt/
 423 #
 424 >>>80   ubequad         0x2008020000000000      : Microsoft Excel 97-2003
 425 !:mime  application/vnd.ms-excel
 426 # https://www.macdisk.com/macsigen.php  XLS5 for Excel 5
 427 !:apple ????XLS9
 428 # 3rd directory entry name
 429 >>>>256         lestring16      _VBA_PROJECT_CUR        addin
 430 !:ext   xla/
 431 # 4th directory entry name
 432 >>>>384         lestring16      _VBA_PROJECT_CUR        addin
 433 !:ext   xla
 434 #!:ext  xla/
 435 >>>>256         default         x                       worksheet or template
 436 !:ext   xls/xlt
 437 #!:ext  xls/xlt/
 438 #
 439 # URL:  http://fileformats.archiveteam.org/wiki/OLE2
 440 >>>80   ubequad         0x0b0d020000000000      : Microsoft Outlook 97-2003 item
 441 #>>>80  ubequad         0x0b0d020000000000      : Microsoft Outlook 97-2003 Message
 442 #!:mime application/vnd.ms-outlook
 443 !:mime  application/x-ms-msg
 444 !:ext   msg
 445 # URL:  https://wiki.fileformat.com/email/oft/
 446 >>>80   ubequad         0x46f0060000000000      : Microsoft Outlook 97-2003 item template
 447 #!:mime application/vnd.ms-outlook
 448 !:mime  application/x-ms-oft
 449 !:ext   oft
 450 #
 451 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 452 >>>80   ubequad         0x5148040000000000      : Microsoft PowerPoint 4.0 presentation
 453 !:mime  application/vnd.ms-powerpoint
 454 # https://www.macdisk.com/macsigen.php
 455 !:apple ????PPT3
 456 !:ext   ppt
 457 # Summary:      "newer" Greenstreet Art drawing
 458 # From:         Joerg Jenderek
 459 # URL:          http://fileformats.archiveteam.org/wiki/GST_ART
 460 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml
 461 # Note:         called like "Greenstreet Art drawing" by TrID
 462 # Note:         CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16
 463 #               verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART`
 464 >>>80   ubequad         0x602c020000000000      : Greenstreet Art drawing
 465 #!:mime application/x-ole-storage
 466 !:mime  image/x-greenstreet-art
 467 !:ext   art
 468 >>>80   default         x
 469 >>>>0   use             ole2-unknown
 470 #??
 471 # URL:  http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
 472 >>88    ubequad         0xa29a00aa004a1a72      : Microsoft
 473 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 474 >>>80   ubequad         0xc2dbcd28e20ace11      Works 4 document
 475 !:mime  application/vnd.ms-works
 476 !:apple ????AWWP
 477 !:ext   wps
 478 #
 479 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
 480 >>>80   ubequad         0xc3dbcd28e20ace11      Works 4 database
 481 !:mime  application/vnd.ms-works-db
 482 !:apple ????AWDB
 483 !:ext   wdb/bdb
 484 #??
 485 >>88    ubequad         0xa40700c04fb932ba      : Microsoft
 486 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
 487 >>>80   ubequad         0xb25aa40e0a9ed111      Works 5-6 document
 488 !:mime  application/vnd.ms-works
 489 !:apple ????AWWP
 490 !:ext   wps
 491 # From:         Joerg Jenderek
 492 # URL:          https://en.wikipedia.org/wiki/Microsoft_Works
 493 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 494 # Note:         probably version 6 and 7
 495 # organize pictures like JPFG images in streams __cf1 with names like
 496 # 001.JPG, 002.JPG ... in streams __fname
 497 >>88    ubequad         0xa1c800c04f612452      : Microsoft
 498 >>>80   ubequad         0xc0c7266eb98cd311      Works portfolio
 499 # 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed
 500 #!:mime application/x-ole-storage
 501 # https://www.iana.org/assignments/media-types/application/vnd.ms-works
 502 !:mime  application/vnd.ms-works
 503 # https://extension.nirsoft.net/wsb
 504 # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
 505 !:ext   wsb
 506 #??
 507 # URL:  http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
 508 >>88    ubequad         0x00c0000000000046      : Microsoft
 509 >>>80   ubequad         0x0112020000000000      Publisher
 510 !:mime  application/vnd.ms-publisher
 511 !:ext   pub
 512 #
 513 # URL:  http://fileformats.archiveteam.org/wiki/PPT
 514 #??
 515 >>88    ubequad         0xa90300aa00510ea3      : Microsoft
 516 >>>80   ubequad         0x70ae7bea3bfbcd11      PowerPoint 95 presentation
 517 !:mime  application/vnd.ms-powerpoint
 518 # https://www.macdisk.com/macsigen.php
 519 !:apple ????PPT3
 520 !:ext   ppt/pot
 521 #??
 522 >>88    ubequad         0x86ea00aa00b929e8      : Microsoft
 523 >>>80   ubequad         0x108d81649b4fcf11      PowerPoint 97-2003 presentation or template
 524 !:mime  application/vnd.ms-powerpoint
 525 !:apple ????PPT3
 526 # /autostart/template
 527 !:ext   ppt/pps/pot
 528 # From:         Joerg Jenderek
 529 # URL:          https://www.file-extensions.org/ppa-file-extension
 530 #               https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231
 531 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 532 >>88    ubequad         0x871800aa0060263b      : Microsoft
 533 # only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org)
 534 >>>80   ubequad         0xf04672810a72cf11      PowerPoint Addin or Wizard
 535 # second, third and fourth directory entry name like VBA PROJECT PROJECTwm
 536 # http://extension.nirsoft.net/pwz
 537 !:mime  application/vnd.ms-powerpoint
 538 # like: BSHPPT97.PPA "AutoContent Wizard.pwz"
 539 !:ext   ppa/pwz
 540 #
 541 # From:         Joerg Jenderek
 542 # URL:          http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document)
 543 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml
 544 # Note:         called "Microsoft At Work Fax document" by TrID
 545 >>88    ubequad         0xb29400dd010f2bf9      : Microsoft
 546 >>>80   ubequad         0x801cb0023de01a10      At Work fax Document
 547 #!:mime application/x-ole-storage
 548 !:mime  image/x-ms-awd
 549 !:ext   awd
 550 #
 551 # URL:  https://en.wikipedia.org/wiki/Microsoft_Project
 552 #??
 553 >>88    ubequad         0xbe1100c04fb6faf1      : Microsoft
 554 >>>80   ubequad         0x3a8fb774c8c8d111      Project
 555 !:mime  application/vnd.ms-project
 556 !:ext   mpp
 557 # From:         Joerg Jenderek
 558 # URL:          https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder
 559 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml
 560 #               http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 561 # Note:         only version 8 tested and called "Office Binder Document" by TrID and
 562 #               "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240
 563 >>88    ubequad         0xb21c00aa004ba90b      : Microsoft
 564 >>>80   ubequad         0x0004855964661b10      Office Binder Document, Template or wizard
 565 # second directory entry name like Binder
 566 # https://www.file-extensions.org/obd-file-extension
 567 #!:mime application/vnd.ms-binder
 568 !:mime  application/x-msbinder
 569 # obt for template; obz for Microsoft Office Binder wizard
 570 !:ext   obd/obt/obz
 571 #
 572 # URL:          http://fileformats.archiveteam.org/wiki/WordPerfect
 573 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 574 #               https://github.com/OneWingedShark/WordPerfect/
 575 #               blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm
 576 # From:         Joerg Jenderek
 577 # Note:         internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd
 578 # 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN,
 579 # which contains WordPerfect document \xffWPC signature handled by ./wordprocessors
 580 >>88    ubequad         0x19370000929679cd      : WordPerfect 7
 581 >>>80   ubequad         0xff739851ad2d2002      Document
 582 !:mime  application/vnd.wordperfect
 583 #!:apple        ????WPC?
 584 # https://fossies.org/linux/wp2latex/test/ole6.wpd
 585 !:ext   wpd
 586 #>>>>0  search/0xc01/s  \xffWPC                 \b, WPC SIGNATURE
 587 # inspect embedded WordPerfect document by ./wordprocessors with 1 space at end
 588 #>>>>>&0        indirect        x       \b; contains
 589 # GRR: the above expression does not work correctly
 590 #
 591 # URL:  http://fileformats.archiveteam.org/wiki/SHW_(Corel)
 592 #???
 593 >>88    ubequad         0x99ae04021c007002      : WordPerfect
 594 >>>80   ubequad         0x62fe2e4099191b10      7-X3 presentation
 595 !:mime  application/x-corelpresentations
 596 #!:mime application/x-shw-viewer
 597 #!:mime image/x-presentations
 598 !:ext   shw
 599 #
 600 # URL:  http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
 601 >>>80   ubequad         0x60fe2e4099191b10      9 Graphic
 602 #!:mime application/x-wpg
 603 #!:mime image/x-wordperfect-graphics
 604 !:mime  image/x-wpg
 605 # https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
 606 !:apple ????WPC9
 607 !:ext   wpg
 608 #
 609 # From:         Joerg Jenderek
 610 # URL:          http://fileformats.archiveteam.org/wiki/CorelCAD
 611 #               https://en.wikipedia.org/wiki/CorelCAD
 612 # Reference:    http://mark0.net/download/triddefs_xml.7z/defs/c/ccd-corelcad.trid.xml
 613 # Note:         called "CorelCAD Drawing" by TrID and CorelCAD
 614 # directory entry names like Contents ViewInfo CustomViewDescriptions LayerInfo
 615 >>88    ubequad         0xbe26db67235e2689      : Corel
 616 >>>80   ubequad         0x20f414de1cacce11      \bCAD Drawing or Template
 617 #!:mime application/x-ole-storage
 618 !:mime  application/x-corel-cad
 619 # CCT for CorelCAD Template
 620 !:ext   ccd/cct
 621 #
 622 # URL:  http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
 623 >>88    ubequad         0x996104021c007002      : StarOffice
 624 >>>80   ubequad         0x407e5cdc5cb31b10      StarWriter 3.0 document or template
 625 # https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
 626 !:mime  application/x-starwriter
 627 !:ext   sdw/vor
 628 #
 629 >>>80   ubequad         0xa03f543fa6b61b10      StarCalc 3.0 spreadsheet or template
 630 !:mime  application/x-starcalc
 631 !:ext   sdc/vor
 632 #
 633 >>>80   ubequad         0xe0aa10af6db31b10      StarDraw 3.0 drawing or template
 634 !:mime  application/x-starimpress
 635 #!:mime application/x-stardraw
 636 # sda ??
 637 !:ext   sdd/sda/vor
 638 #??
 639 >>88    ubequad         0x89cb008029e4b0b1      : StarOffice
 640 >>>80   ubequad         0x41d461633542d011      StarCalc 4.0 spreadsheet or template
 641 !:mime  application/x-starcalc
 642 !:ext   sdc/vor
 643 #
 644 >>>80   ubequad         0x61b8a5c6d685d111      StarCalc 5.0 spreadsheet or template
 645 !:mime  application/vnd.stardivision.cal
 646 !:ext   sdc/vor
 647 #
 648 >>>80   ubequad         0xc03c2d011642d011      StarImpress 4.0 presentation or template
 649 !:mime  application/x-starimpress
 650 !:ext   sdd/vor
 651 #??
 652 >>88    ubequad         0xb12a04021c007002      : StarOffice
 653 >>>80   ubequad         0x600459d4fd351c10      StarMath 3.0
 654 !:mime  application/x-starmath
 655 !:ext   smf
 656 #??
 657 >>88    ubequad         0x8e2c00001b4cc711      : StarOffice
 658 >>>80   ubequad         0xe0999cfb6d2c1c10      StarChart 3.0
 659 !:mime  application/x-starchart
 660 !:ext   sds
 661 #??
 662 >>88    ubequad         0xa45e00a0249d57b1      : StarOffice
 663 >>>80   ubequad         0xb0e9048b0e42d011      StarWriter 4.0 document or template
 664 !:mime  application/x-starwriter
 665 !:ext   sdw/vor
 666 #??
 667 >>88    ubequad         0x89ca008029e4b0b1      : StarOffice
 668 >>>80   ubequad         0xe1b7b3022542d011      StarMath 4.0
 669 !:mime  application/x-starmath
 670 !:ext   smf
 671 #
 672 >>>80   ubequad         0xe0b7b3022542d011      StarChart 4.0
 673 !:mime  application/x-starchart
 674 !:ext   sds
 675 #??
 676 >>88    ubequad         0xa53f00a0249d57b1      : StarOffice
 677 >>>80   ubequad         0x70c90a340de3d011      Master 4.0 document
 678 !:mime  application/x-starwriter-global
 679 !:ext   sgl
 680 #??
 681 >>88    ubequad         0x89d0008029e4b0b1      : StarOffice
 682 >>>80   ubequad         0x40e6b5ffde85d111      StarMath 5.0
 683 !:mime  application/vnd.stardivision.math
 684 !:ext   smf
 685 #
 686 >>>80   ubequad         0xa005892ebd85d111      StarDraw 5.0 drawing or template
 687 !:mime  application/vnd.stardivision.draw
 688 !:ext   sda/vor
 689 #
 690 >>>80   ubequad         0x21725c56bc85d111      StarImpress 5.0 presentation or template
 691 !:mime  application/vnd.stardivision.impress
 692 # sda is used for what?
 693 !:ext   sdd/vor/sda
 694 #
 695 >>>80   ubequad         0x214388bfdd85d111      StarChart 5.0
 696 !:mime  application/vnd.stardivision.chart
 697 !:ext   sds
 698 # ??
 699 >>88    ubequad         0xaab4006097da561a      : StarOffice
 700 >>>80   ubequad         0xd1f90cc2ae85d111      StarWriter 5.0 document or template
 701 !:mime  application/vnd.stardivision.writer
 702 !:ext   sdw/vor
 703 #
 704 >>>80   ubequad         0xd3f90cc2ae85d111      Master 5.0 document
 705 !:mime  application/vnd.stardivision.writer-global
 706 !:ext   sgl
 707 #??
 708 # URL:  http://fileformats.archiveteam.org/wiki/FlashPix
 709 >>88    ubequad         0x855300aa00a1f95b      : Kodak
 710 >>>80   ubequad         0x0067615654c1ce11      FlashPIX Image
 711 !:mime  image/vnd.fpx
 712 !:apple ????FPix
 713 !:ext   fpx
 714 # URL:  https://en.wikipedia.org/wiki/SoftMaker_Office
 715 >>88    ubequad         0x95f600a0cc3cca14      : PlanMaker
 716 >>>80   ubequad         0x9174088a6452d411      document or template
 717 !:mime  application/vnd.softmaker.planmaker
 718 # pmv for template      https://www.file-extensions.org/pmv-file-extension
 719 !:ext   pmd/pmv
 720 # URL:          http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max)
 721 #               https://en.wikipedia.org/wiki/Autodesk_3ds_Max
 722 # Reference:    http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
 723 # Note:         called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and
 724 #               "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max`
 725 #               applies only to "newer" versions (about 2008-2020)
 726 >>88    ubequad         0x9fed04143144cc1e      : Autodesk
 727 >>>80   ubequad         0x7b8cdd1cc081a045      3ds Max
 728 #!:mime application/x-ole-storage
 729 !:mime  model/x-autodesk-max
 730 # like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max
 731 !:ext   max
 732 # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
 733 #!:ext  max/chr
 734 # remaining non null clsid
 735 >>88    default         x
 736 >>>0    use             ole2-unknown
 737 # display information about directory for not detected CDF files
 738 0       name                    ole2-unknown
 739 >80     ubequad         x                       : UNKNOWN
 740 # https://reposcope.com/mimetype/application/x-ole-storage
 741 !:mime  application/x-ole-storage
 742 # according to file version 5.41 with -e soft option
 743 #!:mime application/CDFV2
 744 #!:ext  ???
 745 >80     ubequad         !0                      \b, clsid %#16.16llx
 746 >>88 ubequad            x                       \b%16.16llx
 747 # converted hexadecimal format to standard GUUID notation
 748 >>80    guid            x                       {%s}
 749 # second directory entry name like VisioDocument Control000
 750 >128    lestring16      x with names %.20s
 751 # third directory entry like WordDocument Preview.dib
 752 >256    lestring16      x %.20s
 753 # forth like \005SummaryInformation
 754 >384    lestring16      x %.25s
 755 # 5th
 756 >512    lestring16      x %.10s
 757 # 6th
 758 >640    lestring16      x %.10s
 759 # 7th
 760 >768    lestring16      x %.10s