Which file format starts with "45 52 02" bytes?

I've got .cdr file format (not CorelDRAW file), however I've trouble opening/burning it. I expect it to be the disk image. Here are the first few lines:

$ hexdump -C *.cdr | head
00000000  45 52 02 00 00 70 00 00  00 00 00 00 00 00 00 00  |ER...p..........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200  ...
$ hdiutil imageinfo *.cdr
hdiutil: imageinfo failed - image not recognized

In what kind of format is this file?

I've checked Magic numbers in files article on Wikipedia, but it's not listed there.

file-format

kenorb

Posted 2018-02-03T23:02:53.897

Reputation: 16 795

19The file command is made specifically to recognize file types by looking at the magic bytes. – Daniel B – 2018-02-03T23:19:39.127

1It very well could be a disk image: .CDR is a disc image created on a Macintosh computer using the built-in Disk Utility program; may contain multiple folders and files in a single disc image file that can be burned to a CD; similar to an .ISO file created on a Windows computer. – Keltari – 2018-02-03T23:17:10.200

If it is a disk image, .cdr files can be renamed to .iso and be recognized as an ISO9660 CD-ROM image. – Thorbjørn Ravn Andersen – 2018-02-04T23:18:46.360

was 30 seconds late :) on OsX the disk image is usually named .cdr but it is in fact a standard ISO 9660. Used this fact to move data from Mac to PC – Giovanni Valerio – 2018-02-04T23:21:05.337

@GiovanniValerio Really? I always have known .dmg files to be macOS disk images. Perhaps on an older version of the OS? – JakeGould – 2018-02-04T23:51:38.350

3.cdr is used when one creates a CD/DVD master and uses the ISO9660 standard / .dmg is used to store/distribute OsX software/data, and can be compressed and encrypted – Giovanni Valerio – 2018-02-05T00:02:11.863

@GiovanniValerio Ahh! Good to know. – JakeGould – 2018-02-05T03:31:38.593

1Not all cdrom image files will be .iso format.... – rackandboneman – 2018-02-05T20:17:11.840

Answers

Well, I am not 100% on this, but it appears to be close to a Roxio Toast disk image file according to the list of file signatures found here on Wikipedia:

Roxio Toast disc image file, also some .dmg-files begin with same bytes.

The hex signature provided there is:

45 52 02 00 00 00

And the hex signature you are sharing is:

45 52 02 00 00 70

Note that the last hex value is 00 instead of 70 so this is even odder. Wonder if the 70 means the image is compressed? Similar info seems to be found in this definitions file for pyfsig; a Python file signature library.

Also—if I recall correctly—the .cdr extension on your file would seem to indicate to me that this disk image file was made with Roxio Toast.

And FWIW, files with the .dmg extension—as mentioned on the Wikipedia page—are macOS “Apple Disk Image” format images.

JakeGould

Posted 2018-02-03T23:02:53.897

Reputation: 38 217

3I'm not sure, but it might be related to a slight discrepancy in the hex signature you used - i.e.: 45 52 02 00 00 00, while the OP's signature is actually: 45 52 02 00 00 70. – jrd1 – 2018-02-04T04:02:02.890

2@jrd1 Excellent point! Will see if I can research this some more. – JakeGould – 2018-02-04T04:11:05.143

The file command tells me its an "Apple Driver Map, blocksize 512":

printf '\x45\x52\x02\x00\x00\x70' | file -
# /dev/stdin: Apple Driver Map, blocksize 512

The definition is in file's sourcecode in the file magic/Magdir/apple.

Interestingly, there is a disabled entry that would match even better: "Apple Partition data".

steiny

Posted 2018-02-03T23:02:53.897

Reputation: 643

17Now this is a great answer! It can be made into a one-liner like this printf '\x45\x52\x02\x00\x00\x70' - | file - and the output would be /dev/stdin: Apple Driver Map, blocksize 512. – JakeGould – 2018-02-03T23:33:40.297

Thanks! Especially for noticing that my suggested printf '\x45\x52\x02\x00\x00\x70' - | file - has an unnecessary - before the pipe |. – JakeGould – 2018-02-05T01:13:19.740

11OP should run file on their actual file. It might have a different answer given the whole thing. – OrangeDog – 2018-02-05T11:05:15.903