winhex ends of file...
 
Notifications
Clear all

winhex ends of files

4 Posts
3 Users
0 Reactions
878 Views
(@schoon)
Active Member
Joined: 16 years ago
Posts: 7
Topic starter  

Hi, Can anyone explain why when i open a .doc file in Winhex, I see
the end of the file padded with zeros to the end of the next sector, as you'd expect.

Yet with image files (I've tried jpeg and png) there is no padding,
Winhex just shows an abrupt termination not to the end of the sector?

TIA!!!!


   
Quote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Word documents always store files as 0x200 byte pages, and so have lengths that are multiples of 0x200.

A JPEG has a specfic length which can be any length. The final two byes will be 0xFF 0xD9


   
ReplyQuote
ForensicRob
(@forensicrob)
Eminent Member
Joined: 20 years ago
Posts: 26
 

Actually, MOST MS Word (pre-2007/OLE2 format) files use 0x200 (512) byte pages/sectors. The file format allows for most any size sectors, but most software developers tend to lock it in at 0x200 bytes. These internal file sector sizes tend to line up with floppy disk sectors. Sometimes there are an even multiple of 2 or 4 to completely fill larger hard drive sectors as well.


   
ReplyQuote
(@schoon)
Active Member
Joined: 16 years ago
Posts: 7
Topic starter  

Thanks to both of you for your excellent and timely responses.


   
ReplyQuote
Share: