WIM file signature
Magic number at the start of the file · MSWIM...
Windows Imaging Format archives begin with the ASCII text MSWIM followed by three NUL bytes. Both normal .wim images and the solid-compressed .esd downloads Windows Update ships use this same container header.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes 4D 53 57 49 4D 00 00 00 (the text MSWIM...), it is a WIM file.
The header bytes after the magic give the header size and version; the LZMS solid compression that makes an .esd smaller changes flags deeper in the file, not this signature.
Formats that use the 4D 53 57 49 signature
These file types in our database carry this signature:
How to check a file's signature
You can read the first bytes of any file yourself. The magic bytes are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.wim
- hexdump -C -n 16 example.wim
- file example.wim
Windows (PowerShell)
- Format-Hex -Path example.wim -Count 16
Python
- open("example.wim","rb").read(8).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the WIM file signature?
WIM files start with the hex bytes 4D 53 57 49 4D 00 00 00 (MSWIM... in ASCII). This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.wim on Linux or macOS, or Format-Hex -Path example.wim -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the WIM signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine WIM file has these exact bytes; a file with the wrong bytes is not really WIM, whatever its name says.