filesig

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Documentation

Overview

Package filesig identifies file types from their magic bytes.

A signature constrains particular byte offsets rather than matching a fixed prefix, so a type with several variants is one entry with several alternatives. Detect answers what a buffer starts with; Scan finds every position a signature holds at, which is what carving an embedded file needs.

Index

Constants

This section is empty.

Variables

View Source 
var Signatures = []Category{
	{Name: "Images", Types: []Sig{
		{
			Name: "Joint Photographic Experts Group image", Extension: "jpg,jpeg,jpe,thm,mpo",
			MIME: "image/jpeg", Description: "",

			Carver: "JPEG",
			// contains filtered or unexported fields
		},
		{
			Name: "Graphics Interchange Format image", Extension: "gif",
			MIME: "image/gif", Description: "",

			Carver: "GIF",
			// contains filtered or unexported fields
		},
		{
			Name: "Portable Network Graphics image", Extension: "png",
			MIME: "image/png", Description: "",

			Carver: "PNG",
			// contains filtered or unexported fields
		},
		{
			Name: "WEBP Image", Extension: "webp",
			MIME: "image/webp", Description: "",

			Carver: "WEBP",
			// contains filtered or unexported fields
		},
		{
			Name: "High Efficiency Image File Format", Extension: "heic,heif",
			MIME: "image/heif", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Camera Image File Format", Extension: "crw",
			MIME: "image/x-canon-crw", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Canon CR2 raw image", Extension: "cr2",
			MIME: "image/x-canon-cr2", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Tagged Image File Format image", Extension: "tif",
			MIME: "image/tiff", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Bitmap image", Extension: "bmp",
			MIME: "image/bmp", Description: "",

			Carver: "BMP",
			// contains filtered or unexported fields
		},
		{
			Name: "JPEG Extended Range image", Extension: "jxr",
			MIME: "image/vnd.ms-photo", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Photoshop image", Extension: "psd",
			MIME: "image/vnd.adobe.photoshop", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Photoshop Large Document", Extension: "psb",
			MIME: "application/x-photoshop", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Paint Shop Pro image", Extension: "psp",
			MIME: "image/psp", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "The GIMP image", Extension: "xcf",
			MIME: "image/x-xcf", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Icon image", Extension: "ico",
			MIME: "image/x-icon", Description: "",

			Carver: "ICO",
			// contains filtered or unexported fields
		},
		{
			Name: "Radiance High Dynamic Range image", Extension: "hdr",
			MIME: "image/vnd.radiance", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Sony ARW image", Extension: "arw",
			MIME: "image/x-raw", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Fujifilm Raw Image", Extension: "raf",
			MIME: "image/x-raw", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Minolta RAW image", Extension: "mrw",
			MIME: "image/x-raw", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Adobe Bridge Thumbnail Cache", Extension: "bct",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Document Imaging", Extension: "mdi",
			MIME: "image/vnd.ms-modi", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Joint Photographic Experts Group image (under Base64)", Extension: "B64",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Portable Network Graphics image (under Base64)", Extension: "B64",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "AutoCAD Drawing", Extension: "dwg,123d",
			MIME: "application/acad", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "AutoCAD Drawing", Extension: "dwg,dwt",
			MIME: "application/acad", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Targa Image", Extension: "tga",
			MIME: "image/x-targa", Description: "",

			Carver: "TARGA",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Video", Types: []Sig{
		{
			Name: "Matroska Multimedia Container", Extension: "mkv",
			MIME: "video/x-matroska", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "WEBM video", Extension: "webm",
			MIME: "video/webm", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Flash MP4 video", Extension: "f4v",
			MIME: "video/mp4", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "MPEG-4 video", Extension: "mp4",
			MIME: "video/mp4", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "M4V video", Extension: "m4v",
			MIME: "video/x-m4v", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Quicktime video", Extension: "mov",
			MIME: "video/quicktime", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Audio Video Interleave", Extension: "avi",
			MIME: "video/x-msvideo", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Media Video", Extension: "wmv",
			MIME: "video/x-ms-wmv", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "MPEG video", Extension: "mpg",
			MIME: "video/mpeg", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Flash Video", Extension: "flv",
			MIME: "video/x-flv", Description: "",

			Carver: "FLV",
			// contains filtered or unexported fields
		},
		{
			Name: "OGG Video", Extension: "ogv,ogm,opus,ogx",
			MIME: "video/ogg", Description: "",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Audio", Types: []Sig{
		{
			Name: "Waveform Audio", Extension: "wav",
			MIME: "audio/x-wav", Description: "",

			Carver: "WAV",
			// contains filtered or unexported fields
		},
		{
			Name: "OGG audio", Extension: "ogg",
			MIME: "audio/ogg", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Musical Instrument Digital Interface audio", Extension: "midi",
			MIME: "audio/midi", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "MPEG-3 audio", Extension: "mp3",
			MIME: "audio/mpeg", Description: "",

			Carver: "MP3",
			// contains filtered or unexported fields
		},
		{
			Name: "MPEG-4 Part 14 audio", Extension: "m4a",
			MIME: "audio/m4a", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Free Lossless Audio Codec", Extension: "flac",
			MIME: "audio/x-flac", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Adaptive Multi-Rate audio codec", Extension: "amr",
			MIME: "audio/amr", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Audacity", Extension: "au",
			MIME: "audio/x-au", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Audacity Block", Extension: "auf",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Audio Interchange File", Extension: "aif",
			MIME: "audio/x-aiff", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Audio Interchange File (compressed)", Extension: "aifc",
			MIME: "audio/x-aifc", Description: "",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Documents", Types: []Sig{
		{
			Name: "Portable Document Format", Extension: "pdf",
			MIME: "application/pdf", Description: "",

			Carver: "PDF",
			// contains filtered or unexported fields
		},
		{
			Name: "Portable Document Format (under Base64)", Extension: "B64",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Adobe PostScript", Extension: "ps,eps,ai,pfa",
			MIME: "application/postscript", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "PostScript", Extension: "ps",
			MIME: "application/postscript", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Encapsulated PostScript", Extension: "eps,ai",
			MIME: "application/eps", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Rich Text Format", Extension: "rtf",
			MIME: "application/rtf", Description: "",

			Carver: "RTF",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Office document/OLE2", Extension: "ole2,doc,xls,dot,ppt,xla,ppa,pps,pot,msi,sdw,db,vsd,msg",
			MIME: "application/msword,application/vnd.ms-excel,application/vnd.ms-powerpoint", Description: "Microsoft Office documents",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Office document/OLE2 (under Base64)", Extension: "B64",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Office 2007+ document", Extension: "docx,xlsx,pptx",
			MIME: "application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.openxmlformats-officedocument.presentationml.presentation", Description: "",

			Carver: "ZIP",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Access database", Extension: "mdb,mda,mde,mdt,fdb,psa",
			MIME: "application/msaccess", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Access 2007+ database", Extension: "accdb,accde,accda,accdu",
			MIME: "application/msaccess", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft OneNote document", Extension: "one",
			MIME: "application/onenote", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Outlook Express database", Extension: "dbx",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Personal Storage Table (Outlook)", Extension: "pst,ost,fdb,pab",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Exchange Database", Extension: "edb",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "WordPerfect document", Extension: "wpd,wp,wp5,wp6,wpp,bk!,wcm",
			MIME: "application/wordperfect", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "EPUB e-book", Extension: "epub",
			MIME: "application/epub+zip", Description: "",

			Carver: "ZIP",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Applications", Types: []Sig{
		{
			Name: "Windows Portable Executable", Extension: "exe,dll,drv,vxd,sys,ocx,vbx,com,fon,scr",
			MIME: "application/vnd.microsoft.portable-executable", Description: "",

			Carver: "MZPE",
			// contains filtered or unexported fields
		},
		{
			Name: "Executable and Linkable Format", Extension: "elf,bin,axf,o,prx,so",
			MIME: "application/x-executable", Description: "Executable and Linkable Format file. No standard file extension.",

			Carver: "ELF",
			// contains filtered or unexported fields
		},
		{
			Name: "MacOS Mach-O object", Extension: "dylib",
			MIME: "application/octet-stream", Description: "",

			Carver: "MACHO",
			// contains filtered or unexported fields
		},
		{
			Name: "MacOS Mach-O 64-bit object", Extension: "dylib",
			MIME: "application/octet-stream", Description: "",

			Carver: "MACHO",
			// contains filtered or unexported fields
		},
		{
			Name: "Adobe Flash", Extension: "swf",
			MIME: "application/x-shockwave-flash", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Java Class", Extension: "class",
			MIME: "application/java-vm", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Dalvik Executable", Extension: "dex",
			MIME: "application/octet-stream", Description: "Dalvik Executable as used by Android",
			// contains filtered or unexported fields
		},
		{
			Name: "Google Chrome Extension", Extension: "crx",
			MIME: "application/crx", Description: "Google Chrome extension or packaged app",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Archives", Types: []Sig{
		{
			Name: "PKZIP archive", Extension: "zip",
			MIME: "application/zip", Description: "",

			Carver: "ZIP",
			// contains filtered or unexported fields
		},
		{
			Name: "PKZIP archive (under Base64)", Extension: "B64",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "TAR archive", Extension: "tar",
			MIME: "application/x-tar", Description: "",

			Carver: "TAR",
			// contains filtered or unexported fields
		},
		{
			Name: "Roshal Archive", Extension: "rar",
			MIME: "application/x-rar-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Gzip", Extension: "gz",
			MIME: "application/gzip", Description: "",

			Carver: "GZIP",
			// contains filtered or unexported fields
		},
		{
			Name: "Bzip2", Extension: "bz2",
			MIME: "application/x-bzip2", Description: "",

			Carver: "BZIP2",
			// contains filtered or unexported fields
		},
		{
			Name: "7zip", Extension: "7z",
			MIME: "application/x-7z-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Zlib Deflate", Extension: "zlib",
			MIME: "application/x-deflate", Description: "",

			Carver: "Zlib",
			// contains filtered or unexported fields
		},
		{
			Name: "xz compression", Extension: "xz",
			MIME: "application/x-xz", Description: "",

			Carver: "XZ",
			// contains filtered or unexported fields
		},
		{
			Name: "Tarball", Extension: "tar.z",
			MIME: "application/x-gtar", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "ISO disk image", Extension: "iso",
			MIME: "application/octet-stream", Description: "ISO 9660 CD/DVD image file",
			// contains filtered or unexported fields
		},
		{
			Name: "Virtual Machine Disk", Extension: "vmdk",
			MIME: "application/vmdk,application/x-virtualbox-vmdk", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Virtual Hard Drive", Extension: "vhd",
			MIME: "application/x-vhd", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Macintosh disk image", Extension: "dmf,dmg",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "ARJ Archive", Extension: "arj",
			MIME: "application/x-arj-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "WinAce Archive", Extension: "ace",
			MIME: "application/x-ace-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Macintosh BinHex Encoded File", Extension: "hqx",
			MIME: "application/mac-binhex", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "ALZip Archive", Extension: "alz",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "KGB Compressed Archive", Extension: "kgb",
			MIME: "application/x-kgb-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Microsoft Cabinet", Extension: "cab",
			MIME: "vnd.ms-cab-compressed", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Jar Archive", Extension: "jar",
			MIME: "application/java-archive", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Jar Archive", Extension: "jar",
			MIME: "application/java-archive", Description: "",

			Carver: "ZIP",
			// contains filtered or unexported fields
		},
		{
			Name: "lzop compressed", Extension: "lzop,lzo",
			MIME: "application/x-lzop", Description: "",

			Carver: "LZOP",
			// contains filtered or unexported fields
		},
		{
			Name: "Linux deb package", Extension: "deb",
			MIME: "application/vnd.debian.binary-package", Description: "",

			Carver: "DEB",
			// contains filtered or unexported fields
		},
		{
			Name: "Apple Disk Image", Extension: "dmg",
			MIME: "application/x-apple-diskimage", Description: "",
			// contains filtered or unexported fields
		},
	}},
	{Name: "Miscellaneous", Types: []Sig{
		{
			Name: "UTF-8 text", Extension: "txt",
			MIME: "text/plain", Description: "UTF-8 encoded Unicode byte order mark, commonly but not exclusively seen in text files.",
			// contains filtered or unexported fields
		},
		{
			Name: "UTF-32 LE text", Extension: "utf32le",
			MIME: "charset/utf32le", Description: "Little-endian UTF-32 encoded Unicode byte order mark.",
			// contains filtered or unexported fields
		},
		{
			Name: "UTF-16 LE text", Extension: "utf16le",
			MIME: "charset/utf16le", Description: "Little-endian UTF-16 encoded Unicode byte order mark.",
			// contains filtered or unexported fields
		},
		{
			Name: "Web Open Font Format", Extension: "woff",
			MIME: "application/font-woff", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Web Open Font Format 2", Extension: "woff2",
			MIME: "application/font-woff", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Embedded OpenType font", Extension: "eot",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "TrueType Font", Extension: "ttf",
			MIME: "application/font-sfnt", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "OpenType Font", Extension: "otf",
			MIME: "application/font-sfnt", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "SQLite", Extension: "sqlite",
			MIME: "application/x-sqlite3", Description: "",

			Carver: "SQLITE",
			// contains filtered or unexported fields
		},
		{
			Name: "BitTorrent link", Extension: "torrent",
			MIME: "application/x-bittorrent", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Cryptocurrency wallet", Extension: "wallet",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Registry fragment", Extension: "hbin",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Registry script", Extension: "rgs",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "WinNT Registry Hive", Extension: "registry",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Event Log", Extension: "evt",
			MIME: "application/octet-stream", Description: "",

			Carver: "EVT",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Event Log", Extension: "evtx",
			MIME: "application/octet-stream", Description: "",

			Carver: "EVTX",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Pagedump", Extension: "dmp",
			MIME: "application/octet-stream", Description: "",

			Carver: "DMP",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Prefetch", Extension: "pf",
			MIME: "application/x-pf", Description: "",

			Carver: "PF",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Prefetch (Win 10)", Extension: "pf",
			MIME: "application/x-pf", Description: "",

			Carver: "PFWin10",
			// contains filtered or unexported fields
		},
		{
			Name: "PList (XML)", Extension: "plist",
			MIME: "application/xml", Description: "",

			Carver: "PListXML",
			// contains filtered or unexported fields
		},
		{
			Name: "PList (binary)", Extension: "bplist,plist,ipmeta,abcdp,mdbackup,mdinfo,strings,nib,ichat,qtz,webbookmark,webhistory",
			MIME: "application/x-plist", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "MacOS X Keychain", Extension: "keychain",
			MIME: "application/octet-stream", Description: "",

			Carver: "MacOSXKeychain",
			// contains filtered or unexported fields
		},
		{
			Name: "TCP Packet", Extension: "tcp",
			MIME: "application/tcp", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "UDP Packet", Extension: "udp",
			MIME: "application/udp", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Compiled HTML", Extension: "chm,chw,chi",
			MIME: "application/vnd.ms-htmlhelp", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Password", Extension: "pwl",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Bitlocker recovery key", Extension: "bitlocker",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Certificate", Extension: "cer,cat,p7b,p7c,p7m,p7s,swz,rsa,crl,crt,der",
			MIME: "application/pkix-cert", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Certificate", Extension: "cat,swz,p7m",
			MIME: "application/vnd.ms-pki.seccat", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "PGP pubring", Extension: "pkr,gpg",
			MIME: "application/pgp-keys", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "PGP secring", Extension: "skr",
			MIME: "application/pgp-keys", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "PGP Safe", Extension: "pgd",
			MIME: "application/pgp-keys", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Task Scheduler", Extension: "job",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Windows Shortcut", Extension: "lnk",
			MIME: "application/x-ms-shortcut", Description: "",

			Carver: "LNK",
			// contains filtered or unexported fields
		},
		{
			Name: "Bash", Extension: "bash",
			MIME: "application/bash", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Shell", Extension: "sh",
			MIME: "application/sh", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Python", Extension: "py,pyc,pyd,pyo,pyw,pyz",
			MIME: "application/python", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Ruby", Extension: "rb",
			MIME: "application/ruby", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "perl", Extension: "pl,pm,t,pod",
			MIME: "application/perl", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "php", Extension: "php,phtml,php3,php4,php5,php7,phps,php-s,pht,phar",
			MIME: "application/php", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Smile", Extension: "sml",
			MIME: "\tapplication/x-jackson-smile", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "Lua Bytecode", Extension: "luac",
			MIME: "application/x-lua", Description: "",
			// contains filtered or unexported fields
		},
		{
			Name: "WebAssembly binary", Extension: "wasm",
			MIME: "application/octet-stream", Description: "",
			// contains filtered or unexported fields
		},
	}},
}

Functions

func IsImage 

func IsImage(buf []byte) string

IsImage returns the image mime of buf, or "" if buf is not a known image.

func IsTypeMatch 

func IsTypeMatch(re *regexp.Regexp, buf []byte) string

IsTypeMatch returns the mime of the first detected type whose mime matches re, or "" if none.

Types

type Category 

type Category struct {
	Name  string
	Types []Sig
}

Category groups file signatures as in CyberChef's FILE_SIGNATURES object.

type Match 

type Match struct {
	Offset  int
	Details Sig
}

Match is one signature match found by scanForFileTypes, at the offset the file it describes would start at.

func Scan 

func Scan(buf []byte, categories []string) []Match

Scan reports every position in buf at which a signature matches, in order of increasing offset. detectFileType only asks what the buffer starts with; this is what carving needs, since an embedded file can begin anywhere. categories filters to those category names; nil means all categories.

type Sig 

type Sig struct {
	Name        string
	Extension   string
	MIME        string
	Description string

	// Carver names the algorithm that can cut a file of this type out of a
	// larger buffer, or is empty when there is none. carvers maps it to the
	// function; the indirection keeps the generated table free of Go identifiers.
	Carver string
	// contains filtered or unexported fields
}

Sig is one file-type signature. It matches if ANY of its alternative byte patterns (alts) fully matches the buffer.

func Detect 

func Detect(buf []byte, categories []string) []Sig

Detect returns every file signature that matches buf. categories filters to those category names; nil means all categories.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.