ANALYSIS FORENSIC DIAGNOSTIC

Unknown File Identifier

Give it a mystery file and it tells you what the hell it actually is — with the evidence to back it up, not just a name. Drop in a file with no extension, a wrong extension, or a name you don't trust.

File

Common error messages this diagnoses

If you're here because something threw one of these, this tool shows you exactly what's wrong and how much is recoverable:

  • "Windows cannot open this file" — usually means the extension is wrong or missing — this tool identifies the real format from its content.
  • "This file does not have a program associated with it for performing this action" — same root cause — the OS is going by extension, not content.
  • "Unknown file type" — generic fallback most tools show when they don't recognize the header.

What this tool deliberately skips

The signature database is large but not exhaustive, and deep structural validation — real evidence, not just magic bytes — only exists for PNG, the ZIP family (docx/xlsx/pptx/apk/jar/epub/odf), JPEG, PDF, and SQLite so far. Everything else gets magic-byte-only confidence, clearly labeled as such. A few format families are skipped entirely because their signatures aren't reliable enough to report with confidence — a wrong guess is worse than an honest "unknown."

PCX, dBASE (.dbf)
Only a single ambiguous byte at offset 0 — far too likely to collide with random binary data.
AutoCAD DWG
The version string ("AC1027", "AC1032", …) changes with every release; there's no fixed byte pattern to match against.
BitTorrent (.torrent)
Bencoded dictionaries don't guarantee key order, so there's no fixed byte sequence at the start of every valid file.
Netpbm (.pbm/.pgm/.ppm)
Only a 2-byte magic ("P1"–"P6") — too short to trust on its own.
Apple Disk Image (.dmg)
Its real signature ("koly") lives in a trailer at the end of the file, not the header — this tool only inspects the start of a file.
Targa (.tga)
No header magic at all; the only signature TGA defines is an optional footer at the very end of the file.
Standard (non-placeable) WMF, CramFS
Their headers are too short or version-dependent to distinguish confidently from unrelated binary data.
Raw MP3 without an ID3 tag
A bare MPEG audio frame sync is only 11 bits set in the first two bytes — too weak to match without false positives.

If a file like this comes back "unknown," that's usually why — not a bug. The Hex Damage Map tool can still help you eyeball the raw bytes by hand.