file (command)

file is a standard Unix program for recognizing the type of data contained in a computer file.

History [edit]

The original version of file originated in Unix Research Version 4^[1] in 1973. System V brought a major update with several important changes, most notably moving the file type information into an external text file rather than compiling it into the binary itself.

All major BSD and Linux distributions use a free, open-source reimplementation which was written in 1986-87 by Ian Darwin^[2] from scratch. It was expanded by Geoff Collyer in 1989 and since then has had input from many others, including Guy Harris, Chris Lowth and Eric Fischer; from late 1993 onward its maintenance has been organized by Christos Zoulas.

Specification [edit]

The Single Unix Specification (SUS) specifies that a series of tests are performed on the file specified on the command line:

1. if the file cannot be read, its status undetermined, or its type undetermined, file will indicate that the file was processed and its type was undetermined.
2. file must be able to determine the types directory, FIFO, socket, block special file, and character special file
3. zero-length files are identified as such
4. an initial part of file is considered and file is to use position-sensitive tests
5. the entire file is considered and file is to use context-sensitive tests
6. the file is identified as a data file

file's position-sensitive tests are normally implemented by matching various locations within the file against a textual database of magic numbers (see the Usage section). This differs from other simpler methods such as file extensions and schemes like MIME.

In most implementations, the file command uses a database to drive the probing of the lead bytes. That database is implemented in a file called magic, whose location is usually in /etc/magic, /usr/share/file/magic or a similar location.

Usage [edit]

The SUS mandates the following options:

-M file, specify a file specially formatted containing position-sensitive tests; default position-sensitive tests and context-sensitive tests will not be performed

-m file, as for -M, but default tests will be performed after the tests contained in file.

-d, perform default position-sensitive and context-sensitive tests to the given file; this is the default behaviour unless -M or -m is specified

-h, do-not-dereference symbolic links that point to an existing file or directory

-L, dereference the symbolic link that points to an existing file or directory

-i, do not classify the file further than to identify it as either: nonexistent, a block special file, a character special file, a directory, a FIFO, a socket, a symbolic link, or a regular file

Other Unix and Unix-like operating systems may add extra options than these.

The command tells only what the file looks like, not what it is (in the case where file looks at the content). It is easy to fool the program by putting a magic number into a file the content of which does not match it. Thus the command is not usable as a security tool other than in specific situations.

Examples [edit]

# file file.c
file.c: C program text

# file program
program: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked
    (uses shared libs), stripped

# file /dev/wd0a
/dev/wd0a: block special (0/0)

# file -s /dev/hda1
/dev/hda1: Linux/i386 ext2 filesystem

# file -s /dev/hda5
/dev/hda5: Linux/i386 swap file

# file compressed.gz
compressed.gz: gzip compressed data, deflated, original filename, `compressed', last
    modified: Thu Jan 26 14:08:23 2006, os: Unix

# file data.ppm
data.ppm: Netpbm PPM "rawbits" image data

$ file /Applications/Safari.app/Contents/MacOS/Safari 
/Applications/Safari.app/Contents/MacOS/Safari: Mach-O universal binary with 2 architectures
/Applications/Safari.app/Contents/MacOS/Safari (for architecture ppc7400):      Mach-O executable ppc
/Applications/Safari.app/Contents/MacOS/Safari (for architecture i386): Mach-O executable i386

Libmagic library [edit]

As of version 4.00 of the Ian Darwin/Christos Zoulas version of file, the functionality of file is incorporated into a libmagic library that is accessible via C (and C-compatible) linking;^[3][4] file is implemented using that library.^[5][6]

References [edit]

External links [edit]

• file: determine file type – Commands & Utilities Reference, The Single UNIX® Specification, Issue 7 from The Open Group

Manual pages [edit]

• file(1) – OpenBSD General Commands Manual
• file(1) – Linux User Commands Manual
• libmagic(3) – NetBSD Library Functions Manual
• libmagic(3) – Linux Library Functions Manual

Other [edit]

• Fine Free File Command – homepage for version of file used in major BSD and Linux distributions.
• The libmagic-dev package on packages.debian.org
• TrID, an alternative providing ranked answers (instead of just one) based on statistics.