OneNote File Signature: E4 52 5C 7B 8C D8 A7 4D (Magic Number)

A OneNote section file begins with a fixed 16-byte GUID, {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3} stored in its little-endian byte order. Microsoft's MS-ONESTORE specification defines it as the file-type GUID of the .one revision store.

What this magic number means

A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 (the text .R\{...M..Sx.)..), it is an OneNote file.

GUID signatures like this one read differently from how they are written: the first three groups are little-endian, which is why the file starts E4 52 5C 7B rather than 7B 5C 52 E4.

What each byte of E4 52 5C 7B means

Here is the signature byte by byte, the way a hex editor shows it: the position in the file, the value in hex and in decimal, and the character that value stands for in ASCII. Bytes with no printable character show a dot.

Byte offset	Hex	Decimal	ASCII
0	E4	228	.
1	52	82	R
2	5C	92	\
3	7B	123	{
4	8C	140	.
5	D8	216	.
6	A7	167	.
7	4D	77	M
8	AE	174	.
9	B1	177	.
10	53	83	S
11	78	120	x
12	D0	208	.
13	29	41	)
14	96	150	.
15	D3	211	.

Formats that use the E4 52 5C 7B signature

These file types in our database carry this signature:

How to check a file's signature

You can read the bytes of any file yourself. They are shown in hex, the same way this page lists them.

Linux & macOS

xxd -l 16 example.one
hexdump -C -n 16 example.one
file example.one

Windows (PowerShell)

Format-Hex -Path example.one -Count 16

Python

open("example.one","rb").read(16).hex()

In your browser

Drop the file into the WhatFileType identifier, which reads the signature without uploading it.

Frequently asked questions

What is the OneNote file signature?

OneNote files start with the hex bytes E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 (.R\{...M..Sx.).. in ASCII). This magic number identifies the format regardless of the file's name or extension.

How do I check a file's magic number?

Open the file in a hex editor, or run a command such as xxd -l 16 example.one on Linux or macOS, or Format-Hex -Path example.one -Count 16 in Windows PowerShell, and read the first bytes.

Can a file fake the OneNote signature?

Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine OneNote file has these exact bytes; a file with the wrong bytes is not really OneNote, whatever its name says.

Related signatures

Sources

Reuse this signature

This entry is part of the WhatFileType file signature reference, published under a CC BY 4.0 licence with the full provenance for every entry, a copy-paste embed and a JSON export. Credit WhatFileType and the data is yours to republish.

Byte offset	Hex	Decimal	ASCII
0	E4	228	.
1	52	82	R
2	5C	92	\
3	7B	123	{
4	8C	140	.
5	D8	216	.
6	A7	167	.
7	4D	77	M
8	AE	174	.
9	B1	177	.
10	53	83	S
11	78	120	x
12	D0	208	.
13	29	41	)
14	96	150	.
15	D3	211	.

Byte offset	Hex	Decimal	ASCII
0	E4	228	.
1	52	82	R
2	5C	92	\
3	7B	123	{
4	8C	140	.
5	D8	216	.
6	A7	167	.
7	4D	77	M
8	AE	174	.
9	B1	177	.
10	53	83	S
11	78	120	x
12	D0	208	.
13	29	41	)
14	96	150	.
15	D3	211	.

Byte offset	Hex	Decimal	ASCII
0	E4	228	.
1	52	82	R
2	5C	92	\
3	7B	123	{
4	8C	140	.
5	D8	216	.
6	A7	167	.
7	4D	77	M
8	AE	174	.
9	B1	177	.
10	53	83	S
11	78	120	x
12	D0	208	.
13	29	41	)
14	96	150	.
15	D3	211	.