TIFF file signature
Magic number at the start of the file · II*.
TIFF encodes its own byte order in the first two bytes: II for little-endian or MM for big-endian, followed by the number 42. Many camera raw formats, including Adobe DNG, are TIFF containers and share this header.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes 49 49 2A 00 (the text II*.), the file uses the TIFF header. That is not the same as saying it is a TIFF image: Adobe DNG, Canon CR2, Nikon NEF and Sony ARW are TIFF containers too and open with exactly these four bytes. The header names the container, and the tags inside it name the format.
Because so many raw formats sit on top of TIFF, these bytes are a container test rather than a format test. A reader that needs the exact format goes on to the image file directory: DNG files carry the DNGVersion tag (50706), CR2 files carry a CR2 magic in their second IFD, and an ordinary TIFF carries neither.
The .raw extension is deliberately absent from the list below. It is not one format: some raw files are TIFF-derived and do start II*, while others are headerless sensor dumps that do not, so claiming this signature for the extension as a whole would be wrong.
What each byte of 49 49 2A 00 means
Here is the signature byte by byte, the way a hex editor shows it: the position in the file, the value in hex and in decimal, and the character that value stands for in ASCII. Bytes with no printable character show a dot.
| Byte offset | Hex | Decimal | ASCII |
|---|---|---|---|
| 0 | 49 | 73 | I |
| 1 | 49 | 73 | I |
| 2 | 2A | 42 | * |
| 3 | 00 | 0 | . |
Signature variants
TIFF appears with more than one byte pattern. These all identify the same family:
| Hex signature | Offset | Note |
|---|---|---|
| 49 49 2A 00 | 0 | little-endian (Intel, II) |
| 4D 4D 00 2A | 0 | big-endian (Motorola, MM) |
Formats that use the 49 49 2A 00 signature
These file types in our database carry this signature:
It is also seen in: CR2, NEF, ARW.
How to check a file's signature
You can read the bytes of any file yourself. They are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.tiff
- hexdump -C -n 16 example.tiff
- file example.tiff
Windows (PowerShell)
- Format-Hex -Path example.tiff -Count 16
Python
- open("example.tiff","rb").read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the TIFF file signature?
TIFF files start with the hex bytes 49 49 2A 00 (II*. in ASCII). Read strictly, those bytes say the file uses the TIFF header. That is not the same as saying it is a TIFF image: Adobe DNG, Canon CR2, Nikon NEF and Sony ARW are TIFF containers too and open with exactly these four bytes. The header names the container, and the tags inside it name the format.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.tiff on Linux or macOS, or Format-Hex -Path example.tiff -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the TIFF signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine TIFF file has these exact bytes; a file with the wrong bytes is not really TIFF, whatever its name says.
Related signatures
Sources
Reuse this signature
This entry is part of the WhatFileType file signature reference, published under a CC BY 4.0 licence with the full provenance for every entry, a copy-paste embed and a JSON export. Credit WhatFileType and the data is yours to republish.