-
Notifications
You must be signed in to change notification settings - Fork 43
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RTFD Files #51
Comments
Unless RTFD files have a unique set of magic bytes, it's probably going to be hard to detect them reliably. It might be possible leverage the RTF format, https://github.com/neilharvey/FileSignatures/blob/master/src/FileSignatures/Formats/RichTextFormat.cs, since that's mostly what RTFD is - an RTF and some attachments. Do you have an example file which you could attach? |
It sounds similar to how Office documents work, which are a zip archive that contain a specific set of files. For example, if you treat a Word document as an archive and list the contents you'll get something similar to the following:
How we detect those is to look for a unique entry which always exists: for Word that would be You might be able to do something along the same lines - but you'll need some example files to look for common patterns. |
Attaching the only example file I have. Ill see about getting other examples. Looks like it has a folder of the filename. |
Looks like it is just archive and has a folder of the same file name and inside there there is a TXT.rtf file. I was able to get a detection to work, but it seems like its easily spoofed if you just create a zip file with that structure. I need to get a mac haha
|
Ah yeah that makes sense. I found this article which seems to confirm what you've found: "An RTFD file is a bundle, containing multiple files. It contains a Rich Text file called TXT.rtf that contains Rich Text formatting commands, as well as commands for including images or other attachments contained within the bundle. Images used in the document are stored in the bundle in their native formats." https://fileformats.fandom.com/wiki/Rich_Text_Format_Directory Glad you managed to get it working! |
Anyone have idea how to add csv and txt file with this utility. |
@Harmeet94Singh No, unfortunately a CSV/TXT file does not have any file signature. |
Is there a way to identify an RTFD file? They are basically a package, but are used on Apple/Macs with TextEdit.
I am currently not on a mac, but one rtfd file I did find on the web, FileSignatures sees it as a zip. Looking at the bytes, it does have the same signature as a zip, but I dont have more examples to test and how to tell if it is an rtfd file and not just a zip file.
RTFD File extension
The text was updated successfully, but these errors were encountered: