- Nationwide Digital Forensic & Cyber Investigation Services
Read the bytes before trusting the extension. ZIP records, compound file streams, workbook content types, and text syntax distinguish native spreadsheets from encrypted packages and disguised exports.
Home › Digital Evidence Authentication › Excel Spreadsheet Authentication › XLSX and XLS Magic Bytes and File Signatures
Quick Answer. An ordinary XLSX is a ZIP package, commonly beginning with 50 4B 03 04. A typical legacy XLS compound file begins D0 CF 11 E0 A1 B1 1A E1. These signatures identify containers, not spreadsheet authenticity. Inspect workbook parts or streams to distinguish XLSX, XLSM, XLSB, encrypted Office packages, and unrelated files. CSV has no mandatory signature.
File identification is the entry point to Excel Spreadsheet Authentication. Continue with XLSX file structure after identifying a ZIP workbook, or use CSV file authentication when the supplied file is a text export rather than a native workbook.
| Question | Short answer |
|---|---|
| What are the XLSX magic bytes? | An ordinary XLSX package commonly starts with the ZIP local file header 50 4B 03 04. Confirm workbook content and package relationships because many unrelated formats use ZIP. |
| What are the legacy XLS compound file magic bytes? | The compound file signature is D0 CF 11 E0 A1 B1 1A E1. A typical Excel 97 to 2003 XLS then contains a Workbook stream with BIFF8 records. |
| Can encrypted XLSX files start with the XLS compound signature? | Yes. Common password encrypted Office packages use a compound container with EncryptionInfo and EncryptedPackage streams instead of exposing the normal ZIP package. |
| Does an XLSM file have different ZIP magic bytes from XLSX? | No. Both use ZIP packaging. Macro enabled workbook content types and a VBA project part such as xl/vbaProject.bin distinguish typical XLSM content. |
| What signature identifies a CSV spreadsheet? | CSV has no mandatory file signature. EF BB BF can mark UTF 8 encoding, but that marker is shared by many text files and does not establish CSV syntax. |
| Can an XLS extension contain HTML instead of an Excel workbook? | Yes. Some exports use HTML tables with an .xls name. Identify HTML markup and report the actual format rather than treating the extension as a binary workbook signature. |
Record beginning 50 4B 03 04 that introduces an individual ZIP member.
ZIP record beginning 50 4B 01 02 that indexes a member's metadata and location.
ZIP record beginning 50 4B 05 06 that closes the ordinary archive directory structure.
Compound file stream containing binary workbook records in typical BIFF8 XLS files.
Compound stream describing the encryption needed to interpret an encrypted Office package.
Compound stream holding the encrypted package payload rather than readable worksheet XML.
Binary VBA project part commonly carried by macro enabled Office packages.
Optional EF BB BF byte order marker identifying a Unicode text encoding, not CSV semantics.
An ordinary XLSX is a ZIP package containing SpreadsheetML parts. The commonly observed opening bytes are 50 4B 03 04, the ZIP local file header signature. That observation establishes a ZIP structure candidate. It does not distinguish a workbook from a Word file, an archive of photographs, or another ZIP based format.
| ZIP record | Hex signature | Role in examination |
|---|---|---|
| Local file header | 50 4B 03 04 | Introduces a member and its local metadata |
| Central directory file header | 50 4B 01 02 | Indexes member attributes and header location |
| End of central directory | 50 4B 05 06 | Records directory location and archive completion information |
Inspect [Content_Types].xml and _rels/.rels. The package relationship to the office document identifies the workbook part, commonly xl/workbook.xml. The workbook's own relationships lead to worksheets and supporting content. Filename resemblance alone is insufficient when a package is malformed or deliberately misleading.
A directory listing containing xl/workbook.xml, worksheet parts, and spreadsheet content types supports identification as a SpreadsheetML workbook. Validate the relationship targets and parse the referenced content. A file called workbook.xml inside an arbitrary ZIP is not enough. The package structure guide explains the next level of validation.
Do not search for 50 4B and stop at the first occurrence. Compressed data and embedded objects can contain matching byte sequences. Read record fields, offsets, lengths, and directory relationships. Compare local headers with central directory entries, and record duplicate names or members that a reader might interpret inconsistently.
The end of central directory record is near the archive end, not necessarily the final 22 bytes because a ZIP comment may follow its fixed fields. ZIP64 archives use additional structures. Truncation, appended bytes, or inconsistent offsets require a documented structural finding rather than a claim that one missing signature proves fabrication.
We inspect signatures and internal members before choosing a parser or opening an attachment. This separates ordinary workbook packaging, encryption wrappers, binary formats, and text exports without assuming that a familiar extension proves native Excel content.
Request Confidential Consultation Call (833) 292 3733The bytes D0 CF 11 E0 A1 B1 1A E1 identify the Compound File Binary container. Typical Excel 97 to 2003 XLS files use this container, but so do other document formats and common encrypted Office packages. Enumerate the directory streams before calling the file a legacy workbook.
| Container observation | Internal evidence | Supported identification |
|---|---|---|
| Compound signature | Workbook stream containing valid BIFF8 records | Typical legacy binary XLS workbook |
| Compound signature | EncryptionInfo and EncryptedPackage streams | Encrypted Office package wrapper |
| ZIP signature | Spreadsheet XML workbook and matching content types | Ordinary XML workbook package |
| ZIP signature | Binary workbook part such as xl/workbook.bin | Candidate XLSB package requiring binary parsing |
| Readable markup | HTML table structure despite an .xls name | HTML export rather than native BIFF workbook |
A typical BIFF8 XLS stores binary record sequences in the Workbook stream. Parse the record headers and workbook structures rather than treating the stream name as conclusive. Older Excel variants can use other stream names or formats, so the eight compound bytes are not a universal test for every historical file carrying an .xls extension.
The compound directory can also include property streams such as SummaryInformation, conventionally prefixed by a control character in its stored stream name, and DocumentSummaryInformation. These property sets can retain title, author, or application information. They are editable metadata and should be reported separately from the BIFF cell records and source attribution.
A common encrypted XLSX wrapper contains EncryptionInfo and EncryptedPackage. The workbook's XML is not directly available until authorized decryption succeeds. The same wrapper pattern can carry other Office package types, so an .xlsx name plus those streams does not independently establish the decrypted content type.
Record the outer file hash and encryption observations first. If credentials are supplied, preserve the decrypted output as a derived examination artifact and calculate its own hash. Identify its workbook content separately. Do not describe that derived package as byte identical to the encrypted original.
Worksheet protection and workbook structure protection are different from package encryption. They can restrict interface actions while leaving ZIP members and cell values readable. A password prompt must be interpreted in its actual context rather than assumed to mean all spreadsheet content is encrypted.
XLSM and XLSB can share the ZIP opening signature with XLSX. Identify their workbook content types and actual parts. The extension selects an expected interpretation, but the internal package records show whether that interpretation matches the supplied file.
An XLSM package normally contains an XML workbook plus macro enabled content declarations and a VBA project part, commonly xl/vbaProject.bin. Follow relationships to the project rather than searching only by filename. A project can be stored without being executed during the examination.
The presence of vbaProject.bin establishes that a VBA project is present in the package; it does not prove the project ran, changed a cell, or caused an alleged loss. Record its hash and related package declarations. If the extension says XLSX while macro project content remains, report the mismatch and the application's observed response on a controlled copy.
XLSB is a ZIP based binary workbook format. It commonly includes xl/workbook.bin and binary worksheet parts rather than SpreadsheetML worksheet XML. It is not a legacy compound XLS simply because the word binary appears in its name. A ZIP parser can inventory XLSB members but cannot interpret the cell records as XML.
Use an appropriate binary workbook parser and preserve the original package before any conversion. Saving XLSB as XLSX can change record representation, caches, metadata, and supported features. A converted file can assist review, but it is a derivative and cannot replace the collected binary workbook for structural conclusions.
CSV is text with no mandatory magic bytes. HTML is markup that spreadsheet applications can import. Both can be supplied under a spreadsheet looking filename without containing native Excel workbook structures. Identify encoding and syntax before deciding which evidence the file can preserve.
The bytes EF BB BF are an optional UTF 8 byte order marker. Their presence indicates an encoding convention, not CSV identity. A file with no marker can still be valid UTF 8, and CSV can use other encodings. Decode a copy under recorded assumptions and check whether characters are represented consistently.
Assess delimiters, record boundaries, quotation rules, and escaped quotes over the complete text. A comma in the first line does not establish a valid CSV dataset. Regional exports may use semicolons or other delimiters while retaining a .csv extension. Record the observed dialect instead of forcing an interpretation that silently changes column boundaries.
A text export does not carry native worksheet styles, hidden sheet states, or an XLSX formula cache model. Text beginning with an equals sign may be interpreted as a formula when imported, but the raw CSV stores characters. Preserve that raw text before opening it in a spreadsheet application that may convert dates, identifiers, or formulas.
An export named report.xls can begin with markup such as <html> and contain table rows. Whitespace, a text encoding marker, or declarations can precede the visible markup. Parse the document as HTML rather than demanding that the first characters always be one exact tag. Spreadsheet software may open the table while warning that the extension and format differ.
HTML can preserve visible table content and formatting but does not become BIFF8 because Excel can read it. Report it as an HTML spreadsheet export with an .xls extension. An extension mismatch may reflect an ordinary reporting system's export method, not an attempt to deceive. Compare other exports from that system before drawing a conclusion about the sender.
Choose the parser from the bytes and internal structure, then document how that result compares with the supplied filename.
We provide byte signatures, validated container inventories, workbook type findings, and documented extension mismatches. Encrypted and converted derivatives are identified separately so the report does not confuse supplied evidence with later examination outputs. This work is led by subject matter experts in file signature analysis who confirm whether a file is a true XLSX, a legacy XLS, or a renamed export.
Elite Digital Forensics is an independent digital forensics practice serving attorneys, paralegals, in house counsel, insurers, lenders, businesses, and individuals nationwide. Our team includes former law enforcement forensic examiners and court qualified expert witnesses in computer, cell phone, cloud, document, and multimedia forensics. Every engagement begins with a scoped plan, hash verified evidence handling, and a clear explanation of what the examination can answer.
It identifies a ZIP central directory header, not the ordinary local header expected at a typical package start. Validate offsets and the full archive before classifying the workbook.
No. The end of central directory record includes fields and can be followed by a ZIP comment. Interpret the complete record and applicable archive structures.
Not by itself. EncryptionInfo and EncryptedPackage identify a common encryption wrapper; authorized decryption and inspection of the resulting package establish its content type.
No. It establishes stored VBA project content. Execution requires separate evidence such as application artifacts, logs, or a documented behavioral test.
No. Modern XLSB uses ZIP packaging with binary workbook records. Typical BIFF8 XLS uses a compound container, so the required parsing approach differs.
Yes. Some systems use that naming convention for table exports. Document the actual HTML format and compare the system's normal output before interpreting the mismatch.
Send the original attachment rather than a renamed or converted copy. We can identify the actual container, explain extension mismatches, and determine which workbook records are available for further examination. Our court qualified experts in spreadsheet forensics can testify to what the file signature proves.
Request Confidential Consultation Call (833) 292 3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder