- Nationwide Digital Forensic & Cyber Investigation Services
Identify the actual Word container from its bytes, validate its internal records, and distinguish an encrypted package from a legacy DOC before examining the text.
Home › Digital Evidence Authentication › Word Document Authentication › DOCX Magic Bytes and File Signatures
Quick Answer. An ordinary DOCX is a ZIP package, usually beginning with 50 4B 03 04. That identifies ZIP storage, not Word content. Legacy DOC and password encrypted DOCX both begin with D0 CF 11 E0 A1 B1 1A E1. Examiners distinguish them by their internal streams, then check content types, archive boundaries, macros, and extension mismatches.
This signature guide belongs to Word Document Authentication. Start here when a file has an unexpected extension or refuses to open. Continue with DOCX package structure to identify the main document part, or Word forgery detection when the issue concerns fabrication rather than format.
| Question | Short answer |
|---|---|
| What are the magic bytes of an ordinary DOCX? | Usually 50 4B 03 04 at the beginning. Confirm the Word package through content types and relationships because other Office files and ordinary archives share that signature. |
| Does a DOCX always begin with PK? | No. Password encryption can wrap the ZIP package in a compound file. Its visible opening is then the compound signature rather than PK. |
| Which streams identify a legacy DOC file? | A valid WordDocument stream and the selected 0Table or 1Table stream support identification as binary Word. Property streams provide additional context. |
| What does a DOCX end of central directory record contain? | It records archive directory information and a comment length. Its full length, not just its four signature bytes, determines the ordinary ZIP endpoint. |
| How does an RTF disguised as DOC begin? | An RTF begins with the characters {\rtf. Renaming it to DOC changes the label, not its text based format. |
| Does word/vbaProject.bin belong in a DOCX? | It is a VBA project part associated with macro enabled Word packages such as DOCM. Its presence under a DOCX name requires content type and relationship inspection. |
The ZIP record preceding an archived entry. Its signature is 50 4B 03 04; fields describe storage and naming information.
A ZIP entry record beginning 50 4B 01 02 that points to the corresponding local file header.
The ZIP closing record beginning 50 4B 05 06, followed by fixed fields and a variable length comment.
The primary binary Word stream, whose file information block identifies the table stream needed to interpret the document.
Compound storage data describing the encryption method and parameters used for an encrypted Office package.
The compound stream holding the encrypted package representation, unavailable as ordinary readable XML until authorized decryption.
The first bytes classify storage. They do not identify the author, validate the visible wording, or establish a creation date. An ordinary DOCX contains compressed parts within a ZIP archive. The recognizable PK bytes appear in several different record signatures, each with its own purpose.
| Record | Signature | What to verify |
|---|---|---|
| Local entry header | 50 4B 03 04 | Name length, flags, compression method, and entry data location. |
| Central directory entry | 50 4B 01 02 | Local header offset, stored entry name, sizes, and CRC value. |
| Directory closing record | 50 4B 05 06 | Directory size, directory offset, entry count, and comment length. |
Inspect [Content_Types].xml and _rels/.rels. Follow the package relationship to the main office document part. In a conventional Word package that target is word/document.xml. Check its WordprocessingML structure and declared content type. A ZIP containing arbitrary files renamed DOCX is not a Word package.
Compare central directory records with local headers. Some fields can legitimately differ when a writer uses data descriptors, so interpret flags before reporting a contradiction. Duplicate entry names deserve special attention: different readers can choose different copies. Record which entry a parser selected instead of silently treating one extraction as the whole file.
Use an archive listing before decompression. Apply resource limits to entry counts, expanded sizes, and nesting. A small compressed file can expand dramatically. The structure guide explains the relationship checks that follow this initial classification.
Send the native file through an agreed secure collection process. We can identify its container without enabling macros, following external links, or changing its extension on the preserved original.
Request Confidential Consultation Call (833) 292 3733The eight bytes D0 CF 11 E0 A1 B1 1A E1 identify a compound file. They do not distinguish binary Word from encrypted Open XML. Read the compound directory and validate its streams before choosing a parser.
| Observed structure | Likely interpretation | Required follow through |
|---|---|---|
| WordDocument with 0Table or 1Table | Legacy binary DOC | Read the file information block and the selected table stream. |
| SummaryInformation and DocumentSummaryInformation | Property sets commonly associated with legacy Office | Preserve property values and types; directory names include an initial control character. |
| EncryptionInfo and EncryptedPackage | Password encrypted Office package | Identify encryption parameters and arrange authorized decryption. |
| Other compound streams without Word structures | Another structured storage format or damaged file | Do not classify it as DOC from the opening bytes alone. |
A legacy document can use 0Table or 1Table. The file information block in WordDocument tells the reader which one to use. Finding both names does not establish two document versions. Likewise, SummaryInformation properties are descriptive fields, not independent confirmation that a named person wrote the text.
Encryption changes what can be inspected without credentials. Record the original encrypted file hash, the acquisition context, and how access was authorized. Hash and label any decrypted derivative separately. A password encrypted DOCX with a compound opening is expected behavior, not an extension fraud finding. Its decrypted package still needs ordinary ZIP and Word structure validation.
The name can disagree with the bytes through export settings, compatibility workflows, mistakes, or deliberate disguise. Report the disagreement precisely. A DOC label on RTF is not equivalent to an executable falsely presented as a Word attachment.
RTF commonly opens with { tf followed by a format version. It is a text based control language rather than a ZIP or compound package. Preserve the original suffix in the evidence record and identify the true format separately. Renaming a working copy can help a controlled test, but it does not convert the data.
A DOCM is a macro enabled Word package. Its ZIP opening looks like DOCX. Inspect word/vbaProject.bin, the relationship to that part, and the main document content type. A project part alone does not establish that code executed, that it is malicious, or that a user enabled macros.
A DOCX name combined with macro content is an inconsistency requiring explanation. The archive might have been renamed from DOCM, manually edited, or produced by an unusual writer. Examine content types and relationships together. Also distinguish VBA projects from other active features such as linked templates or embedded objects.
Perform static classification in an isolated environment. Do not enable content merely to obtain a thumbnail or test whether the document opens. Preserve application warnings if rendering is necessary. The authenticity checklist places a format mismatch alongside source and chronology evidence rather than treating it as an automatic forgery verdict.
First calculate the legitimate record boundary. The end of central directory has a fixed structure followed by a declared comment. Bytes within that comment are archive content, not unexplained trailing data. ZIP64 archives introduce additional records that must also be interpreted correctly.
The closing signature can occur incidentally inside compressed data or a comment. Validate candidate records using lengths, directory offsets, and entry counts. A file can contain more than one plausible archive view. Document the interpretation used by each parser when their results differ.
After establishing the logical endpoint, measure any remaining bytes and record their exact offset range. Extract a separate copy for classification and hashing. Readable text, another archive, or an executable signature can direct further examination. Do not execute extracted material. Unusual writer behavior, concatenation, corruption, and intentional concealment are competing explanations.
Report whether trailing material changes the visible document, changes parser behavior, or is simply ignored by the tested reader. These are different findings. A normal rendering does not dispose of hidden appended content, and an unexplained suffix does not by itself demonstrate alteration of a disputed sentence.
This sequence establishes the format and its boundaries before a content parser or document renderer is trusted.
We document container identification with exact signatures, offsets, stream inventories, and package relationships so another examiner can reproduce the classification without opening active content. This analysis is led by subject matter experts in file signature analysis who confirm whether a file is a genuine DOCX, a legacy DOC, or something disguised as either.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
Yes. The opening local header can survive even when directory records or XML parts are missing. Identify which structures remain readable and distinguish repair output from the preserved source.
No. A compound header and encryption streams identify encrypted storage, not the password. Access requires credentials or another specifically authorized recovery process.
Both ordinary formats use ZIP storage. Their internal main parts and content types distinguish a workbook from a Word document.
No. Preserve them as supplied. Their location and content may matter to classification, security, or reconstruction of the handling history.
No. Export conventions and ordinary renaming can explain mismatches. Intent requires additional evidence about how and why the file was supplied.
Yes. Signatures can occur inside data or multiple archive structures can exist. Validate each candidate directory and explain which structure the tested reader actually uses.
A defensible signature finding names the container, its verified internal structures, and any unexplained bytes. It is the starting point for content authentication, not a substitute for it. Our court qualified experts in document forensics can testify to what the file signature establishes.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder