database

sleuthit-2.09 一个磁盘的工具集

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford ([e-mail])
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <[e-mail]>
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
0	string	GDBM		GNU dbm 2.x database
#
# Berkeley DB
#
# Ian Darwin's file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.

0	long	0x00061561	Berkeley DB
>8	belong	4321
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, native byte-order)
>8	belong	1234
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, little-endian)

0	belong	0x00061561	Berkeley DB
>8	belong	4321
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, big-endian)
>8	belong	1234
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, native byte-order)

0	long	0x00053162	Berkeley DB 1.85/1.86
>4	long	>0		(Btree, version %d, native byte-order)
0	belong	0x00053162	Berkeley DB 1.85/1.86
>4	belong	>0		(Btree, version %d, big-endian)
0	lelong	0x00053162	Berkeley DB 1.85/1.86
>4	lelong	>0		(Btree, version %d, little-endian)

12	long	0x00061561	Berkeley DB
>16	long	>0		(Hash, version %d, native byte-order)
12	belong	0x00061561	Berkeley DB
>16	belong	>0		(Hash, version %d, big-endian)
12	lelong	0x00061561	Berkeley DB
>16	lelong	>0		(Hash, version %d, little-endian)

12	long	0x00053162	Berkeley DB
>16	long	>0		(Btree, version %d, native byte-order)
12	belong	0x00053162	Berkeley DB
>16	belong	>0		(Btree, version %d, big-endian)
12	lelong	0x00053162	Berkeley DB
>16	lelong	>0		(Btree, version %d, little-endian)

12	long	0x00042253	Berkeley DB
>16	long	>0		(Queue, version %d, native byte-order)
12	belong	0x00042253	Berkeley DB
>16	belong	>0		(Queue, version %d, big-endian)
12	lelong	0x00042253	Berkeley DB
>16	lelong	>0		(Queue, version %d, little-endian)

# From Max Bowsher.
12	long	0x00040988	Berkeley DB
>16	long	>0		(Log, version %d, native byte-order)
12	belong	0x00040988	Berkeley DB 
>16	belong	>0		(Log, version %d, big-endian)
12	lelong	0x00040988	Berkeley DB
>16	lelong	>0		(Log, version %d, little-endian)

#
#
# Round Robin Database Tool by Tobias Oetiker <[e-mail]>
0	string	RRD		RRDTool DB
>4	string	x		version %s
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0       string  root\0  ROOT file
>4      belong  x       Version %d
>33     belong  x       (Compression: %d)

# XXX: Weak magic.
# Alex Ott <[e-mail]>
## Paradox file formats
#2	  leshort	0x0800	Paradox 
#>0x39	  byte		3	v. 3.0 
#>0x39	  byte		4	v. 3.5 
#>0x39	  byte		9	v. 4.x 
#>0x39	  byte		10	v. 5.x 
#>0x39	  byte		11	v. 5.x 
#>0x39	  byte		12	v. 7.x 
#>>0x04	  byte		0	indexed .DB data file 
#>>0x04	  byte		1	primary index .PX file 
#>>0x04	  byte		2	non-indexed .DB data file 
#>>0x04	  byte		3	non-incrementing secondary index .Xnn file 
#>>0x04	  byte		4	secondary index .Ynn file 
#>>0x04	  byte		5	incrementing secondary index .Xnn file 
#>>0x04	  byte		6	non-incrementing secondary index .XGn file 
#>>0x04	  byte		7	secondary index .YGn file 
#>>>0x04	  byte		8	incrementing secondary index .XGn file 
## XBase database files
#0      byte       0x02	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x03	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x04	
#>8     leshort	  >0
#>>12   leshort    0	dBASE IV no memo file 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x05	
#>8     leshort	  >0
#>>12   leshort    0	dBASE V no memo file 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x30
#>8     leshort	  >0
#>>12   leshort    0	Visual FoxPro 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x43
#>8     leshort	  >0
#>>12   leshort    0	FlagShip with memo var size 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x7b
#>8     leshort	  >0
#>>12   leshort    0	dBASEIV with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x83	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase+, dBaseIII+ with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x8b
#>8     leshort	  >0
#>>12   leshort    0	dBaseIV with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x8e	
#>8     leshort	  >0
#>>12   leshort    0	dBaseIV with SQL Table 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0xb3
#>8     leshort	  >0
#>>12   leshort    0	FlagShip with .dbt memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0xf5
#>8     leshort	  >0
#>>12   leshort    0	FoxPro with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0	leshort		0x0006		DBase 3 index file

# MS Access database
4	  string	Standard\ Jet\ DB	Microsoft Access Database

# TDB database from Samba et al - Martin Pool <[e-mail]>
0	string	TDB\ file		TDB database
>32	lelong	0x2601196D		version 6, little-endian
>>36	lelong	x			hash size %d bytes

# SE Linux policy database
0       lelong  0xf97cff8c      SE Linux policy
>16     lelong  x               v%d
>20     lelong  1      MLS
>24     lelong  x       %d symbols
>28     lelong  x       %d ocons

# ICE authority file data (Wolfram Kleff)
2	string		ICE		ICE authority data

# X11 Xauthority file (Wolfram Kleff)
10	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
11	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
12	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
13	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
14	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
15	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
16	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
17	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
18	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data