What is a File Signature?

ICSM Computer 1101 14 May 2025

Ask by ICSM Computer

Updated 14 May 2025

1 Answers

ICSM Computer 14 May 2025

A file signature (also called a magic number) is a unique sequence of bytes at the beginning of a file that identifies its file type — regardless of the file extension.

These signatures help operating systems and applications understand the true format of a file, even if the extension is incorrect or missing.

Examples of Common File Signatures

File Type	Hex Signature (first few bytes)	ASCII Equivalent
PDF	`25 50 44 46`	`%PDF`
PNG	`89 50 4E 47 0D 0A 1A 0A`	PNG (non-ASCII)
JPG/JPEG	`FF D8 FF`	(binary)
GIF	`47 49 46 38`	`GIF8`
ZIP	`50 4B 03 04`	`PK..`
DOCX/XLSX	`50 4B 03 04` (because they are ZIP)	`PK..`

Note: Some file types share the same signature (e.g., .zip, .docx, .xlsx) because they are all ZIP-based and need deeper inspection.

Why Use File Signature?

More secure than trusting file extension (which can be renamed).
Helps avoid spoofed file uploads (e.g., virus.exe.jpg).

How to Detect File Type from Signature in C#

Step 1: Build a signature map

var knownSignatures = new Dictionary<string, byte[]>
{
    { ".pdf", new byte[] { 0x25, 0x50, 0x44, 0x46 } },          // %PDF
    { ".png", new byte[] { 0x89, 0x50, 0x4E, 0x47 } },          // PNG
    { ".jpg", new byte[] { 0xFF, 0xD8, 0xFF } },                // JPG
    { ".gif", new byte[] { 0x47, 0x49, 0x46, 0x38 } },          // GIF8
    { ".zip", new byte[] { 0x50, 0x4B, 0x03, 0x04 } },          // PK..
};

Step 2: Detect file extension by matching signature

string DetectFileExtension(string filePath)
{
    byte[] buffer = new byte[8];

    using (var fs = File.OpenRead(filePath))
    {
        fs.Read(buffer, 0, buffer.Length);
    }

    foreach (var pair in knownSignatures)
    {
        var sig = pair.Value;
        if (buffer.Take(sig.Length).SequenceEqual(sig))
            return pair.Key;
    }

    return "unknown";
}

Usage:

string ext = DetectFileExtension("upload.dat");
Console.WriteLine($"Detected file type: {ext}");

Limitations

Some formats share the same signature (e.g., .zip, .docx, .xlsx).
To distinguish them, you'll need to unzip and inspect internal content types.

Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.

Open .md

interview