0

For example, someone corrupted the file before deleting it.

I opened a Word file via vim, or leafpad and deleted information & then changed the file extension to mp4. And then deleted it.

How can I know that this mp4 file was a .doc some times ago, after recovering this file via recuva? Is it possible?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Doe J
  • 9
  • 1

1 Answers1

3

The file extension does not determine what format a file is in; they exist so that applications can identify and open their respective known filetypes, and secondly so users can see what type of file it is (although some file explorers, notably Windows Explorer in Windows 7 and later by default, will hide the file extension if the extension is known).

Most file types contain a file header or "magic number" in the first few bytes of the file that are unique to the particular file type. Tools such as the UNIX file utility exist to read and identify files based on their magic number. Changing or removing the file extension does not affect the contents of the file and thus does not diminish the ability to recover the file type with this method.

forest
  • 64,616
  • 20
  • 206
  • 257
multithr3at3d
  • 12,355
  • 3
  • 29
  • 42
  • 1
    So, if the magic numbers are unchanged, one could determine the original file type. – schroeder Dec 30 '17 at 00:03
  • YM `file`; `find` does something quite different. Also Explorer hides extensions by default back to XP, but displays an icon based on extension (except exe's and dll's which set their own icon). – dave_thompson_085 Dec 30 '17 at 01:45