{
  "version": "1.0",
  "description": "File type detection patterns based on magic numbers",
  "source": "Compiled from file command database and Wikipedia",
  "patterns": [
    {
      "hex": "FFD8FF",
      "offset": 0,
      "type": "image",
      "mime": "image/jpeg",
      "description": "JPEG image",
      "confidence": 1.0
    },
    {
      "hex": "FFD8FFE0",
      "offset": 0,
      "type": "image",
      "mime": "image/jpeg",
      "description": "JPEG/JFIF image",
      "confidence": 1.0
    },
    {
      "hex": "FFD8FFE1",
      "offset": 0,
      "type": "image",
      "mime": "image/jpeg",
      "description": "JPEG/Exif image",
      "confidence": 1.0
    },
    {
      "hex": "89504E470D0A1A0A",
      "offset": 0,
      "type": "image",
      "mime": "image/png",
      "description": "Portable Network Graphics",
      "confidence": 1.0
    },
    {
      "hex": "474946383761",
      "offset": 0,
      "type": "image",
      "mime": "image/gif",
      "description": "GIF87a image",
      "confidence": 1.0
    },
    {
      "hex": "474946383961",
      "offset": 0,
      "type": "image",
      "mime": "image/gif",
      "description": "GIF89a image",
      "confidence": 1.0
    },
    {
      "hex": "424D",
      "offset": 0,
      "type": "image",
      "mime": "image/bmp",
      "description": "Windows bitmap image",
      "confidence": 1.0
    },
    {
      "hex": "49492A00",
      "offset": 0,
      "type": "image",
      "mime": "image/tiff",
      "description": "TIFF image (little-endian)",
      "confidence": 1.0
    },
    {
      "hex": "4D4D002A",
      "offset": 0,
      "type": "image",
      "mime": "image/tiff",
      "description": "TIFF image (big-endian)",
      "confidence": 1.0
    },
    {
      "hex": "52494646",
      "offset": 0,
      "type": "multimedia",
      "mime": "various",
      "description": "RIFF container (WAV, AVI, WebP, etc.)",
      "confidence": 0.8
    },
    {
      "hex": "255044462D",
      "offset": 0,
      "type": "document",
      "mime": "application/pdf",
      "description": "PDF document",
      "confidence": 1.0
    },
    {
      "hex": "D0CF11E0A1B11AE1",
      "offset": 0,
      "type": "document",
      "mime": "application/vnd.ms-office",
      "description": "Microsoft Office document (doc, xls, ppt)",
      "confidence": 1.0
    },
    {
      "hex": "504B0304",
      "offset": 0,
      "type": "archive",
      "mime": "application/zip",
      "description": "ZIP archive (also docx, xlsx, jar, etc.)",
      "confidence": 0.9
    },
    {
      "hex": "504B0506",
      "offset": 0,
      "type": "archive",
      "mime": "application/zip",
      "description": "ZIP archive (empty)",
      "confidence": 1.0
    },
    {
      "hex": "504B0708",
      "offset": 0,
      "type": "archive",
      "mime": "application/zip",
      "description": "ZIP archive (spanned)",
      "confidence": 1.0
    },
    {
      "hex": "1F8B",
      "offset": 0,
      "type": "archive",
      "mime": "application/gzip",
      "description": "GZIP compressed data",
      "confidence": 1.0
    },
    {
      "hex": "425A68",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-bzip2",
      "description": "BZIP2 compressed data",
      "confidence": 1.0
    },
    {
      "hex": "377ABCAF271C",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-7z-compressed",
      "description": "7-Zip archive",
      "confidence": 1.0
    },
    {
      "hex": "526172211A0700",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-rar-compressed",
      "description": "RAR archive v1.50+",
      "confidence": 1.0
    },
    {
      "hex": "526172211A070100",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-rar-compressed",
      "description": "RAR archive v5.0+",
      "confidence": 1.0
    },
    {
      "hex": "7573746172",
      "offset": 257,
      "type": "archive",
      "mime": "application/x-tar",
      "description": "POSIX tar archive",
      "confidence": 1.0
    },
    {
      "hex": "FD377A585A00",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-xz",
      "description": "XZ compressed data",
      "confidence": 1.0
    },
    {
      "hex": "4D5A",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-msdownload",
      "description": "DOS MZ executable (EXE, DLL)",
      "confidence": 1.0
    },
    {
      "hex": "7F454C46",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-executable",
      "description": "ELF executable",
      "confidence": 1.0
    },
    {
      "hex": "CAFEBABE",
      "offset": 0,
      "type": "executable",
      "mime": "application/java-vm",
      "description": "Java class file",
      "confidence": 1.0
    },
    {
      "hex": "FEEDFACE",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-mach-binary",
      "description": "Mach-O binary (32-bit)",
      "confidence": 1.0
    },
    {
      "hex": "FEEDFACF",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-mach-binary",
      "description": "Mach-O binary (64-bit)",
      "confidence": 1.0
    },
    {
      "hex": "CEFAEDFE",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-mach-binary",
      "description": "Mach-O binary (reverse byte order)",
      "confidence": 1.0
    },
    {
      "hex": "CFFAEDFE",
      "offset": 0,
      "type": "executable",
      "mime": "application/x-mach-binary",
      "description": "Mach-O binary (64-bit reverse)",
      "confidence": 1.0
    },
    {
      "hex": "213C617263683E",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-archive",
      "description": "Unix archive",
      "confidence": 1.0
    },
    {
      "hex": "494433",
      "offset": 0,
      "type": "audio",
      "mime": "audio/mpeg",
      "description": "MP3 with ID3v2 tag",
      "confidence": 1.0
    },
    {
      "hex": "FFFB",
      "offset": 0,
      "type": "audio",
      "mime": "audio/mpeg",
      "description": "MP3 audio (MPEG-1 Layer 3)",
      "confidence": 0.9
    },
    {
      "hex": "FFF3",
      "offset": 0,
      "type": "audio",
      "mime": "audio/mpeg",
      "description": "MP3 audio (MPEG-2 Layer 3)",
      "confidence": 0.9
    },
    {
      "hex": "FFF2",
      "offset": 0,
      "type": "audio",
      "mime": "audio/mpeg",
      "description": "MP3 audio (MPEG-2.5 Layer 3)",
      "confidence": 0.9
    },
    {
      "hex": "4F676753",
      "offset": 0,
      "type": "multimedia",
      "mime": "application/ogg",
      "description": "OGG container",
      "confidence": 1.0
    },
    {
      "hex": "664C6143",
      "offset": 0,
      "type": "audio",
      "mime": "audio/flac",
      "description": "FLAC audio",
      "confidence": 1.0
    },
    {
      "hex": "4D546864",
      "offset": 0,
      "type": "audio",
      "mime": "audio/midi",
      "description": "MIDI sound file",
      "confidence": 1.0
    },
    {
      "hex": "0000001466747970",
      "offset": 4,
      "type": "video",
      "mime": "video/mp4",
      "description": "MP4 video",
      "confidence": 1.0
    },
    {
      "hex": "0000001866747970",
      "offset": 4,
      "type": "video",
      "mime": "video/mp4",
      "description": "MP4 video",
      "confidence": 1.0
    },
    {
      "hex": "0000002066747970",
      "offset": 4,
      "type": "video",
      "mime": "video/mp4",
      "description": "MP4 video",
      "confidence": 1.0
    },
    {
      "hex": "1A45DFA3",
      "offset": 0,
      "type": "video",
      "mime": "video/x-matroska",
      "description": "Matroska video (MKV)",
      "confidence": 1.0
    },
    {
      "hex": "000001BA",
      "offset": 0,
      "type": "video",
      "mime": "video/mpeg",
      "description": "MPEG video",
      "confidence": 0.9
    },
    {
      "hex": "000001B3",
      "offset": 0,
      "type": "video",
      "mime": "video/mpeg",
      "description": "MPEG video",
      "confidence": 0.9
    },
    {
      "hex": "464C56",
      "offset": 0,
      "type": "video",
      "mime": "video/x-flv",
      "description": "Flash video",
      "confidence": 1.0
    },
    {
      "hex": "3C3F786D6C20",
      "offset": 0,
      "type": "text",
      "mime": "application/xml",
      "description": "XML document",
      "confidence": 0.9
    },
    {
      "hex": "EFBBBF",
      "offset": 0,
      "type": "text",
      "mime": "text/plain",
      "description": "UTF-8 text with BOM",
      "confidence": 0.8
    },
    {
      "hex": "FFFE",
      "offset": 0,
      "type": "text",
      "mime": "text/plain",
      "description": "UTF-16 LE text with BOM",
      "confidence": 0.8
    },
    {
      "hex": "FEFF",
      "offset": 0,
      "type": "text",
      "mime": "text/plain",
      "description": "UTF-16 BE text with BOM",
      "confidence": 0.8
    },
    {
      "hex": "FFFE0000",
      "offset": 0,
      "type": "text",
      "mime": "text/plain",
      "description": "UTF-32 LE text with BOM",
      "confidence": 0.8
    },
    {
      "hex": "0000FEFF",
      "offset": 0,
      "type": "text",
      "mime": "text/plain",
      "description": "UTF-32 BE text with BOM",
      "confidence": 0.8
    },
    {
      "hex": "2321",
      "offset": 0,
      "type": "text",
      "mime": "text/x-shellscript",
      "description": "Shell script (shebang)",
      "confidence": 0.9
    },
    {
      "hex": "7B5C727466",
      "offset": 0,
      "type": "document",
      "mime": "text/rtf",
      "description": "Rich Text Format",
      "confidence": 1.0
    },
    {
      "hex": "38425053",
      "offset": 0,
      "type": "image",
      "mime": "image/vnd.adobe.photoshop",
      "description": "Adobe Photoshop",
      "confidence": 1.0
    },
    {
      "hex": "25215053",
      "offset": 0,
      "type": "document",
      "mime": "application/postscript",
      "description": "PostScript",
      "confidence": 1.0
    },
    {
      "hex": "00010000",
      "offset": 0,
      "type": "font",
      "mime": "font/ttf",
      "description": "TrueType font",
      "confidence": 1.0
    },
    {
      "hex": "774F4646",
      "offset": 0,
      "type": "font",
      "mime": "font/woff",
      "description": "Web Open Font Format",
      "confidence": 1.0
    },
    {
      "hex": "774F4632",
      "offset": 0,
      "type": "font",
      "mime": "font/woff2",
      "description": "Web Open Font Format 2",
      "confidence": 1.0
    },
    {
      "hex": "4F54544F",
      "offset": 0,
      "type": "font",
      "mime": "font/otf",
      "description": "OpenType font",
      "confidence": 1.0
    },
    {
      "hex": "53514C69746520666F726D6174203300",
      "offset": 0,
      "type": "database",
      "mime": "application/x-sqlite3",
      "description": "SQLite database version 3",
      "confidence": 1.0
    },
    {
      "hex": "EDABEEDB",
      "offset": 0,
      "type": "package",
      "mime": "application/x-rpm",
      "description": "RPM package",
      "confidence": 1.0
    },
    {
      "hex": "213C617263683E0A",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-archive",
      "description": "Unix ar archive",
      "confidence": 1.0
    },
    {
      "hex": "4449434D",
      "offset": 128,
      "type": "medical",
      "mime": "application/dicom",
      "description": "DICOM medical image",
      "confidence": 1.0
    },
    {
      "hex": "0A0D0D0A",
      "offset": 0,
      "type": "network",
      "mime": "application/x-pcapng",
      "description": "PCAP-NG network capture",
      "confidence": 1.0
    },
    {
      "hex": "D4C3B2A1",
      "offset": 0,
      "type": "network",
      "mime": "application/vnd.tcpdump.pcap",
      "description": "PCAP capture (little-endian)",
      "confidence": 1.0
    },
    {
      "hex": "A1B2C3D4",
      "offset": 0,
      "type": "network",
      "mime": "application/vnd.tcpdump.pcap",
      "description": "PCAP capture (big-endian)",
      "confidence": 1.0
    },
    {
      "hex": "4C5A4950",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-lzip",
      "description": "LZIP compressed",
      "confidence": 1.0
    },
    {
      "hex": "303730373031",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-cpio",
      "description": "CPIO archive",
      "confidence": 1.0
    },
    {
      "hex": "4D534346",
      "offset": 0,
      "type": "archive",
      "mime": "application/vnd.ms-cab-compressed",
      "description": "Microsoft Cabinet file",
      "confidence": 1.0
    },
    {
      "hex": "49545346",
      "offset": 0,
      "type": "installer",
      "mime": "application/x-chm",
      "description": "Microsoft Compiled HTML Help",
      "confidence": 1.0
    },
    {
      "hex": "3F5F",
      "offset": 0,
      "type": "help",
      "mime": "application/x-winhelp",
      "description": "Windows Help File",
      "confidence": 0.9
    },
    {
      "hex": "4C01",
      "offset": 0,
      "type": "object",
      "mime": "application/x-object",
      "description": "Object file",
      "confidence": 0.8
    },
    {
      "hex": "2142444E",
      "offset": 0,
      "type": "mail",
      "mime": "application/vnd.ms-outlook",
      "description": "Outlook PST file",
      "confidence": 1.0
    },
    {
      "hex": "CFAD12FE",
      "offset": 0,
      "type": "mail",
      "mime": "application/vnd.ms-outlook",
      "description": "Outlook OST file",
      "confidence": 1.0
    },
    {
      "hex": "46726F6D20",
      "offset": 0,
      "type": "mail",
      "mime": "message/rfc822",
      "description": "Email message (mbox)",
      "confidence": 0.6
    },
    {
      "hex": "52657475726E2D50617468",
      "offset": 0,
      "type": "mail",
      "mime": "message/rfc822",
      "description": "Email bounce message",
      "confidence": 0.8
    },
    {
      "hex": "789C",
      "offset": 0,
      "type": "archive",
      "mime": "application/zlib",
      "description": "Zlib compressed data",
      "confidence": 0.9
    },
    {
      "hex": "1F9D",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-compress",
      "description": "Compressed file (LZW)",
      "confidence": 0.9
    },
    {
      "hex": "1FA0",
      "offset": 0,
      "type": "archive",
      "mime": "application/x-pack",
      "description": "Unix pack compressed data",
      "confidence": 0.7
    },
    {
      "hex": "4C48",
      "offset": 2,
      "type": "archive",
      "mime": "application/x-lha",
      "description": "LHA archive",
      "confidence": 0.8
    },
    {
      "hex": "00000100",
      "offset": 0,
      "type": "image",
      "mime": "image/x-icon",
      "description": "Icon file",
      "confidence": 0.8
    },
    {
      "hex": "00000200",
      "offset": 0,
      "type": "image",
      "mime": "image/x-icon",
      "description": "Cursor file",
      "confidence": 0.8
    },
    {
      "hex": "4344303031",
      "offset": 32769,
      "type": "archive",
      "mime": "application/x-iso9660-image",
      "description": "ISO 9660 CD image",
      "confidence": 1.0
    },
    {
      "hex": "4E45531A",
      "offset": 0,
      "type": "rom",
      "mime": "application/x-nintendo-nes-rom",
      "description": "Nintendo NES ROM",
      "confidence": 1.0
    },
    {
      "hex": "FEEDFEED",
      "offset": 0,
      "type": "swap",
      "mime": "application/x-swap",
      "description": "Swap file",
      "confidence": 0.9
    },
    {
      "hex": "00000002",
      "offset": 0,
      "type": "database",
      "mime": "application/x-tdb",
      "description": "TDB database",
      "confidence": 0.7
    },
    {
      "hex": "01DA0101",
      "offset": 0,
      "type": "database",
      "mime": "application/x-gdbm",
      "description": "GDBM database",
      "confidence": 0.8
    },
    {
      "hex": "00014244",
      "offset": 0,
      "type": "database",
      "mime": "application/x-berkeley-db",
      "description": "Berkeley DB",
      "confidence": 0.8
    },
    {
      "hex": "DEADBEEF",
      "offset": 0,
      "type": "debug",
      "mime": "application/octet-stream",
      "description": "Debug/test pattern",
      "confidence": 0.5
    }
  ]
}