I have a PDF file with extension .pdf. If I remove .pdf - the file is still recognized as PDF file ($ file sample - output sample: PDF document, version 1.4.)

What is the mechanism of filetype detection in Linux? Windows uses file suffix. I know that there are mime types. Does all popular file formats contain their mimetype in HEX code?

marked as duplicate by don_crissti, Michael Homer, Anthon, G-Man, Archemar Sep 13 '15 at 8:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    You mean "How does file ...?" not "How does Linux ...?" – immibis Sep 13 '15 at 2:38

The detection is done through libmagic which looks for specific byte sequences with magic numbers.

Not the answer you're looking for? Browse other questions tagged or ask your own question.