Question

I tried searching for this but my Google has failed me. I have a directory full of files that are just their GUID:

b3445ffb-55f4-4538-bc6f-13534fd549f6

I know they can be only a handful of file extensions (doc,docx,pdf,jpg), but obviously the file extension does not exist. I could write a script that simply tries to open the file using all the known file extensions, but that wouldn’t be very efficient. Is there anyway to read the file and determine what the file should be?

OSX stores file type codes inside the file, and I was hoping that Windows stored similar metadata inside the file and the file extension was simply a historical artifact. Am I to be so lucky?

NB Since you might be wondering why I have a directory full of GUIDs, the database was suppose to keep track of the GUID and match it up with the filename and extension, but the table was dropped.

Answer 1

These are the file headers that should be on every valid file for that specific type.

JPEG

0xFF 
0xD8 

PDF

0x25
0x50
0x44
0x46

DOC

0xD0 
0xCF 
0x11 
0xE0 
0xA1 
0xB1 
0x1A 
0xE1

DOCX

0x50 
0x4B 
0x03 
0x04

For fun I wrote a little app in F# that matches the files. (Gotta love pattern matching!)

module Program =

    let main () =

        let files = 
            seq {
                for path in System.IO.Directory.GetFiles(directory) do
                    use fs = System.IO.File.OpenRead(path)
                    let buffer = Array.zeroCreate 8
                    let read = fs.Read(buffer, 0, 8)
                    match buffer with
                    | [| 0xFFuy; 0xD8uy; _; _; _; _; _; _; |] -> 
                        yield (path, ".jpg")
                    | [| 0x25uy; 0x50uy; 0x44uy; 0x46uy; _; _; _; _; |] -> 
                        yield (path, ".pdf")
                    | [| 0x50uy; 0x4Buy; 0x03uy; 0x04uy; _; _; _; _; |] -> 
                        yield (path, ".docx")
                    | [| 0xD0uy; 0xCFuy; 0x11uy; 0xE0uy; 0xA1uy; 0xB1uy; 0x1Auy; 0xE1uy; |] -> 
                        yield (path, ".doc")
                    | _ -> 
                        yield (path, ".unk")
            }
            |> Seq.toArray

        System.Console.ReadKey true |> ignore

    main()