4

So I was wondering how would you differentiate ppt, xls and doc files from each other in linux regardless of extensions. I tried 'file' but from the looks of it, all of MSOffice files are categorized under the same file type. Similarly I'm having trouble with docx, xlsx and pptx files, since they're essentially all zip files containing a bunch of xml.

I also tried a python script importing the magic module, but no go.

I'm trying to identify the actual file for a sandbox analysis. And for this specific purpose I need to find the actual file type in order to run it in the sandbox vm (the Windows vm runs everything by extension).

Let's say my sample file is labeled as try.exe, but in reality it's just a doc file. My script will rename it as try.exe.doc, which would work fine for doc files. But since linux identifies all MSOffice files as simple DOC files then there's no way to identify ppt or xls files. As a result the sandbox wont' analyze the sample correctly.

2
  • Well the Thumbnails are enough for identification , extension at the end of its name is also good enough. Identification exactly HOW do you mean it. Linux/Ubuntu will open the file with its appropriate application always , you don't need to worry for adding the extensions to open them.
    – atenz
    Jul 3, 2012 at 14:57
  • I'm trying to identify the actual file for a sandbox analysis. And for this specific purpose I need to find the actual file type in order to run it in the sandbox vm (the Windows vm runs everything by extension). Let's say my sample file is labeled as try.exe, but in reality it's just a doc file. My script will rename it as try.exe.doc, which would work fine for doc files. But since linux identifies all MSOffice files as simple DOC files then there's no way to identify ppt or xls files. As a result the sandbox wont' analyze the sample correctly :(
    – Shelby. S
    Jul 3, 2012 at 15:55

2 Answers 2

2

Use file with -i to get mime-type:

file -i <filename>
2
  • That's what I'm currently using. And it would work for every other file except docx,pptx,xlsx,doc,ppt and xls Edit: $ file -i presentations-tips.ppt presentations-tips.ppt: application/vnd.ms-office; charset=binary $ file -i Project.xls Project.xls: application/vnd.ms-office; charset=binary Notice these two files are xls and ppt files, but they're only identified as a Office documents. And I can't rely on extensions
    – Shelby. S
    Jul 3, 2012 at 15:58
  • Just a wild thought but have you looked at the --magic-files flag? It says "Specify an alternate list of files and directories containing magic. This can be a single item, or a colon-separated list. If a compiled magic file is found alongside a file or directory, it will be used instead."
    – user25656
    Jul 3, 2012 at 17:20
0

You can use mimetype command. Example:

mimetype example.ppt
example.ppt: application/vnd.ms-powerpoint

and

mimetype example.doc 
example.doc: application/vnd.ms-word

However, unlike file -i this MIME-type determination is based on looking-up file extensions (.ppt, .doc etc.) from the shared MIME-info database and changing them will change the MIME-types, too.

With extension altered, the only way to know about a file is to look into its file-signature or magic number, which is same for all Microsoft Office documents(D0 CF 11 E0 or DOCFILE0). So any MS-Office files will be detected as same MIME-type.

1
  • Thank you very much. This is very helpful. Well then, I guess I'll just have to make it work somehow in the sandbox.
    – Shelby. S
    Jul 3, 2012 at 17:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .