ftguess is a Python module to determine the type of a file based on its contents (not its extension or filename). It can be used as a command-line tool or as a Python library.

It is part of the python-oletools package.

• Identifies the file type and container format from file content (magic bytes, internal structure)
• Recognises OLE-based formats (Word 97-2003, Excel 97-2003, PowerPoint 97-2003, MSI, ...)
• Recognises OpenXML/ZIP-based formats (Word 2007+, Excel 2007+, PowerPoint 2007+, XPS, ...)
• Recognises RTF, OneNote, PNG, Windows PE executables, and generic ZIP archives
• Reports the application, container type, file type, MIME content-type, and PRONOM PUID
• For OLE files, reports the root CLSID and its known name
• Supports scanning multiple files, recursive directory traversal, and files inside zip archives
• Can be used as a Python library from your own applications

ftguess [options] <filename> [filename2 ...]

-r                  find files recursively in subdirectories
-z PASSWORD         if the file is a zip archive, open first file from it
                    using the provided password
-f PATTERN          if the file is a zip archive, file(s) to open within it
                    (wildcards * and ? supported, default: *)
-l LEVEL            logging level: debug/info/warning/error/critical
                    (default: warning)

$ ftguess sample.docx

ftguess 0.60.2 on Python 3.10.0 - http://decalage.info/python/oletools
THIS IS WORK IN PROGRESS - Check updates regularly!

File       : sample.docx
File Type  : MS Word 2007+ Document
Description: MS Word 2007+ Document (.docx)
Application: MS Word
Container  : OpenXML
Content-type(s) :
PUID       : None

Import FileTypeGuesser and pass either a file path or raw bytes:

from oletools.ftguess import FileTypeGuesser, FTYPE, CONTAINER, APP

# From a file path:
ftg = FileTypeGuesser(filepath='document.docx')

# From bytes in memory:
with open('document.docx', 'rb') as f:
    data = f.read()
ftg = FileTypeGuesser(data=data)

# Always close when done:
ftg.close()

from oletools.ftguess import FileTypeGuesser, FTYPE, CONTAINER

ftg = FileTypeGuesser(filepath='sample.doc')

if ftg.is_ole():
    print('OLE container detected')
    if ftg.root_clsid:
        print('Root CLSID:', ftg.root_clsid, '-', ftg.root_clsid_name)

if ftg.filetype == FTYPE.WORD97:
    print('This is a Word 97-2003 document, may contain VBA macros')

if ftg.ftype.may_contain_vba:
    print('This file type may contain VBA macros')

ftg.close()

Each FType_* class (accessible via ftg.ftype) exposes:

Use the FTYPE, CONTAINER, and APP classes for comparisons:

from oletools.ftguess import FTYPE, CONTAINER, APP

# FTYPE examples: FTYPE.WORD97, FTYPE.EXCEL2007_XLSM, FTYPE.RTF, FTYPE.UNKNOWN, ...
# CONTAINER examples: CONTAINER.OLE, CONTAINER.OpenXML, CONTAINER.RTF, CONTAINER.ZIP, ...
# APP examples: APP.MSWORD, APP.MSEXCEL, APP.MSPOWERPOINT, APP.UNKNOWN, ...

• Home
• License
• Install
• Contribute, Suggest Improvements or Report Issues
• Tools:
  • ftguess
  • mraptor
  • msodde
  • olebrowse
  • oledir
  • oleid
  • olemap
  • olemeta
  • oleobj
  • oletimes
  • olevba
  • pyxswf
  • rtfobj