Windows Metafile file signature
Magic number at the start of the file
A placeable Windows Metafile begins with D7 CD C6 9A, a header that records its size; a standard WMF starts 01 00 09 00. Both store scalable GDI drawing commands.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file starts with the bytes D7 CD C6 9A, it is a Windows Metafile file.
Signature variants
Windows Metafile appears with more than one byte pattern. These all identify the same family:
| Hex signature | Offset | Note |
|---|---|---|
| D7 CD C6 9A | 0 | placeable WMF |
| 01 00 09 00 | 0 | standard WMF |
Formats that use the D7 CD C6 9A signature
These file types in our database carry this signature:
How to check a file's signature
You can read the first bytes of any file yourself. The magic bytes are shown in hex, the same way this page lists them.
Linux & macOS
- xxd -l 16 example.wmf
- hexdump -C -n 16 example.wmf
- file example.wmf
Windows (PowerShell)
- Format-Hex -Path example.wmf -Count 16
Python
- open("example.wmf","rb").read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the Windows Metafile file signature?
Windows Metafile files start with the hex bytes D7 CD C6 9A. This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Open the file in a hex editor, or run a command such as xxd -l 16 example.wmf on Linux or macOS, or Format-Hex -Path example.wmf -Count 16 in Windows PowerShell, and read the first bytes.
Can a file fake the Windows Metafile signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine Windows Metafile file has these exact bytes; a file with the wrong bytes is not really Windows Metafile, whatever its name says.