OLE2 Compound File file signature
Magic number at the start of the file
The Compound File Binary format is a mini filesystem inside one file. Its eight-byte signature D0 CF 11 E0 A1 B1 1A E1 is shared by legacy Office documents (.doc, .xls, .ppt), Windows Installer packages (.msi) and Outlook messages (.msg).
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes D0 CF 11 E0 A1 B1 1A E1, it is a OLE2 Compound File file.
Because so many unrelated types share this header, the extension and the internal storage streams, not the magic bytes, decide what a compound file really is.
The same container also carries Microsoft Publisher (.pub) and Works (.wps) documents and Korean HWP 5.x word-processor files, so a D0 CF 11 E0 header alone never identifies the application.
Formats that use the D0 CF 11 E0 signature
These file types in our database carry this signature:
How to check a file's signature
You can read the first bytes of any file yourself. The magic bytes are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.doc
- hexdump -C -n 16 example.doc
- file example.doc
Windows (PowerShell)
- Format-Hex -Path example.doc -Count 16
Python
- open("example.doc","rb").read(8).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the OLE2 Compound File file signature?
OLE2 Compound File files start with the hex bytes D0 CF 11 E0 A1 B1 1A E1. This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.doc on Linux or macOS, or Format-Hex -Path example.doc -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the OLE2 Compound File signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine OLE2 Compound File file has these exact bytes; a file with the wrong bytes is not really OLE2 Compound File, whatever its name says.