The raw header is the first part of a file, shown byte by byte instead of as named metadata fields. Many file formats start with a fixed pattern of bytes, often called a signature or magic number. Programs read that pattern to learn what kind of file it is.
In a metadata report, the Raw Header field shows these bytes as hexadecimal numbers. Each pair of characters, such as 89 or FF, stands for 1 byte.
An email also has a header section at the top, with fields such as From, To, and Subject. This article covers the header of a file.
What the value looks like
Hexadecimal, or base 16, writes each byte as 2 characters from the digits 0 to 9 and the letters A to F. A byte can therefore have any value from 00 to FF.
In the ASCII character code, the values 21 to 7E stand for letters, digits, and punctuation, and 20 is a space. Values below 20 are control codes, and 00 is the all-zeros character called NUL.
How to read a raw header as text
To turn a raw header into text, look up each byte in an ASCII table. Only bytes from 20 to 7E stand for a visible ASCII character or a space. Other bytes do not, so you can often read only part of a header.
25 50 44 46 2Dreads as a percent sign, the letters PDF, and a hyphen.89 50 4E 47holds the lettersPNGin bytes 2 to 4.
Typical values
Common formats start with these signatures:
- PNG image:
89 50 4E 47 0D 0A 1A 0A - JPEG image:
FF D8 FF, whereFF D8marks the start of the image - GIF image:
47 49 46 38, then39 61or37 61(GIF89a or GIF87a) - PDF document:
25 50 44 46 2D, then the version, such as 1.7 - TIFF image, little-endian:
49 49 2A 00(II, then the number 42) - TIFF image, big-endian:
4D 4D 00 2A(MM, then the number 42) - ZIP archive, and ZIP-based Office files such as DOCX:
50 4B 03 04(PK) - MP3 audio with an ID3v2 tag:
49 44 33(ID3) - WAV audio:
52 49 46 46(RIFF), 4 bytes that vary, then57 41 56 45(WAVE) - MP4 video: a 4-byte size, then
66 74 79 70(ftyp)
In a TIFF file, the first 2 bytes also set the byte order for the numbers in the file. In a PDF file, the characters after the signature give the PDF version, but an entry later in the file can override it.
Which files carry it
Every file has a raw header, but not every format has a signature. Plain text files start directly with their text. Programs recognize them because their first bytes contain only text characters.
Why it matters
The file name extension is only part of the name, and anyone can change it. The header can reveal the real file type and MIME type even when the extension is wrong.
A web server may send no MIME type, or a browser may believe the type it received is wrong. The browser may then compare the first bytes with a table of known patterns. The Unix file command looks for a magic number near the start of the file.
A header also helps you spot problems. If a file named photo.png does not start with 89 50 4E 47, it does not follow the PNG format. The start of the file may be damaged, or the file may be another type with the wrong extension.
A header made only of 00 bytes matches no common signature. But an MP4 file can start with 00, because a small size in its first 4 bytes begins with zero. When nothing matches and the bytes are not text, browsers treat the file as application/octet-stream.