Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Sometimes it seems that the standard file command (5.04 on my Ubuntu system) is not sophisticated enough (or I am just using it wrong, which could well be).

For example when I run it on an .exe file, and I am quite positive that it contains some archive, I would expect output like this:

$ improved-file foo.exe
foo.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
         .zip archive included (just use unzip to extract)

Other issues:

  • It doesn't detect concatenations of different formats
  • It doesn't detect common file formats, e.g. .epub, which is just a .zip container with some standardized .xml files etc. inside (file displays 'data')

An example of such a .exe file containing an archive - I guessed some archive-formats and tried the corresponding unpack-commands with a trial'n'error approach - which worked in the end - but I would rather prefer a more auto-inspection oriented workflow.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

I can't think of an all-in-one tool, but there are programs that can cope with a large array of files of a given category.

For example, p7zip recognizes a large number of archive formats, so if you suspect that a file is an archive, try running 7z l on it.

$ 7z l ta12b563enu.exe
…
Type = Cab
Method = MSZip
…

If you suspect that a file is an image, try ImageMagick.

$ identify keyboard.jpg.gz
keyboard.jpg.gz=>/tmp/magick-XXV8aR5R JPEG 639x426 639x426+0+0 8-bit DirectClass 37.5KB 0.000u 0:00.000

For audio or video files, try mplayer -identify -frames 0.

If you find a file that file can't identify, you might make a feature request to the author of your magic library.

share|improve this answer
    
awesome hints, had nearly forgotten identify and would have never thought of 7z handling other formats –  maxschlepzig Sep 7 '11 at 21:51
    
Mentioned in man mplayer... The wrapper script TOOLS/midentify.sh suppresses the other MPlayer output and (hopefully) shellescapes the filenames. ... I found mine in /usr/share/mplayer –  Peter.O Sep 7 '11 at 23:20

There is nothing wrong with file. It is doing just what it is supposed to be doing: examining the file based on the rules in the magic(5) file. If you wish to come up with a generic way to identify these types of files, then you can submit new magic rules. Read the manpage for magic for more information.

One thing I doubt file will ever do is "detect concatenations". There is no way to determine when the next segment would start without scanning every byte in the file - something file does not do, or want to do.

Incidentally, to distinguish a epub file, you would need to detect the difference between it and an ear file, which uses the same basic structure.

share|improve this answer
    
What is an ear file? With .epub I would expect that file would detect at least .zip - I mean, .zip is really old and relatively common ... (file 5.04 just prints 'data' on my system) –  maxschlepzig Sep 7 '11 at 7:02
    
Newer versions (both 10.10 and 11.04) show Zip archive data, at least v1.0 to extract. An ear file is a jar file (which is packaged with zip) that includes a META-INF directory and a /META-INF/application.xml file. –  Arcege Sep 7 '11 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.