What Is a DOC File? The Same 8 Bytes Start DOC, XLS and PPT Files

2 How Do You Know Your File Is a DOC File? The first 8 bytes are shared, so read the streams

Many pages call d0 cf 11 e0 a1 b1 1a e1 the signature of DOC files. It is the signature of the container, the Compound File Binary format. Our own earlier page on this site said OLECF, which is the same mistake. We built DOC, XLS and PPT files, and all three start with those 8 bytes.

The file command named all three Composite Document File V2 Document. Its answer added the author, the title and the times, and nothing that says Word. 7-Zip printed Type = Compound for all three. So neither tool separates a DOC file from a spreadsheet or a slide show.

The PRONOM entry identifies DOC files by more than the first bytes. Its entry checks the container, the stream named WordDocument and the text Word.Document.8 inside the stream named CompObj. Our DOC files had all three. The CompObj stream of our XLS file said Biff8 instead, and the PPT file said MS PowerPoint 97.

The script below does the same job with the Python standard library. It reads the container, lists the streams and finds WordDocument. Then it reads the Word header, called the FIB, and prints the problems it can see. Save it as check_doc.py and give it the name of your DOC file.

#!/usr/bin/env python3
"""check_doc.py: look inside a .doc file without opening Word.
Usage: python3 check_doc.py file.doc [more files]
Prints the first 8 bytes, what kind of file it is, the size, the streams
of a compound file, the Word header (FIB) fields and any problems found."""
import struct, sys

SIG = bytes.fromhex('d0cf11e0a1b11ae1')
END, FREE = 0xFFFFFFFE, 0xFFFFFFFF

def chain(fat, start, limit):
    out, seen = [], set()
    while start < 0xFFFFFFF0:
        if start in seen:
            return out, 'loop'
        if start >= len(fat):
            return out, 'outside FAT'
        seen.add(start); out.append(start); start = fat[start]
        if len(out) > limit:
            return out, 'too long'
    return out, None

def check(path):
    data = open(path, 'rb').read()
    print(f'{path}: {len(data):,} bytes, starts {data[:8].hex(" ")}')
    problems = []
    if not data:
        print('  empty file'); return ['empty file']
    if data[:4] == b'PK\x03\x04':
        print('  kind: ZIP-based (a DOCX or ODT renamed to .doc)'); return []
    if data[:5] == b'{\\rtf':
        print('  kind: RTF text'); return []
    head = data[:512].lstrip().lower()
    if head.startswith((b'<?xml', b'<html', b'<!doctype')):
        print('  kind: XML or HTML text'); return []
    if data[:8] != SIG:
        at = data[:65536].find(SIG)
        if at > 0:
            print(f'  signature found at offset {at}: extra bytes come before the file')
            return [f'signature at offset {at}']
        printable = sum(32 <= b < 127 or b in (9, 10, 13) for b in data[:2000]) / max(1, len(data[:2000]))
        print('  kind: plain text' if printable > 0.95 else '  kind: not a compound file (no signature)')
        return [] if printable > 0.95 else ['no compound file signature']
    if len(data) < 512:
        print('  too short for a compound file header'); return ['short header']
    major, shift = struct.unpack_from('<HxxH', data, 0x1A)[0], struct.unpack_from('<H', data, 0x1E)[0]
    if shift not in (9, 12):
        problems.append(f'sector shift {shift}')
        print('  header problem:', problems[-1]); return problems
    ss = 1 << shift
    nfat, dstart, _, cutoff, mfstart, nmf, difstart, ndif = struct.unpack_from('<IIIIIIII', data, 0x2C)
    # sector n lives at (n + 1) * ss
    def sector(n):
        off = (n + 1) * ss
        return data[off:off + ss] if off + ss <= len(data) else None
    nsect = len(data) // ss - 1
    if len(data) % ss:
        problems.append('size is not a multiple of the sector size')
    fatlocs = [x for x in struct.unpack_from('<109I', data, 0x4C) if x < 0xFFFFFFF0]
    fat = []
    for loc in fatlocs:
        s = sector(loc)
        if s is None:
            problems.append(f'FAT sector {loc} is past the end of the file'); continue
        fat += struct.unpack(f'<{ss // 4}I', s)
    if not fat:
        problems.append('no readable FAT'); print('  problems:', '; '.join(problems)); return problems
    dchain, err = chain(fat, dstart, nsect + 8)
    if err: problems.append(f'directory chain: {err}')
    dirdata = b''.join(sector(n) or b'' for n in dchain)
    if len(dirdata) < len(dchain) * ss:
        problems.append('directory goes past the end of the file')
    entries = []
    for i in range(0, len(dirdata) - 127, 128):
        e = dirdata[i:i + 128]
        nl = struct.unpack_from('<H', e, 64)[0]
        typ = e[66]
        if typ == 0 or nl < 2 or nl > 64: continue
        name = e[:nl - 2].decode('utf-16le', 'replace')
        entries.append((name, typ, struct.unpack_from('<I', e, 116)[0], struct.unpack_from('<Q', e, 120)[0]))
    if not entries:
        problems.append('directory is empty or unreadable')
        print('  problems:', '; '.join(problems)); return problems
    streams = [e for e in entries if e[1] == 2]
    print('  streams:', ', '.join(repr(e[0]) if ord(e[0][0]) < 32 else e[0] for e in streams))
    word = next((e for e in streams if e[0] == 'WordDocument'), None)
    if not word:
        names = {e[0] for e in streams}
        if 'Workbook' in names or 'Book' in names: print('  kind: Excel workbook (XLS), not a Word file')
        elif 'PowerPoint Document' in names: print('  kind: PowerPoint (PPT), not a Word file')
        elif any(n.startswith('__properties_version') for n in names): print('  kind: Outlook message (MSG)')
        else: print('  kind: compound file without a WordDocument stream')
        problems.append('no WordDocument stream'); return problems
    name, typ, start, size = word
    if size >= cutoff:
        ch, err = chain(fat, start, nsect + 8)
        if err: problems.append(f'WordDocument chain: {err}')
        body = b''.join((sector(n) or b'') for n in ch)[:size]
        if len(body) < size: problems.append('WordDocument is cut short')
    else:
        root = next(e for e in entries if e[1] == 5)
        rch, _ = chain(fat, root[2], nsect + 8)
        mini = b''.join(sector(n) or b'' for n in rch)
        mchain, _ = chain(fat, mfstart, nsect + 8)
        mfat = struct.unpack(f'<{len(b"".join(sector(n) or b"" for n in mchain)) // 4}I', b''.join(sector(n) or b'' for n in mchain)) if mchain else ()
        ch, err = chain(mfat, start, 100000)
        body = b''.join(mini[n * 64:n * 64 + 64] for n in ch)[:size]
    if len(body) < 12:
        problems.append('WordDocument stream is unreadable'); print('  problems:', '; '.join(problems)); return problems
    wident, nfib, _, lid, _, flags = struct.unpack_from('<6H', body, 0)
    print(f'  WordDocument: {size:,} bytes, wIdent {wident:#06x}, nFib {nfib:#06x}')
    if wident != 0xA5EC: problems.append('wIdent is not 0xA5EC')
    if nfib not in (0xC1, 0xD9, 0x101, 0x10C, 0x112): problems.append(f'nFib {nfib:#06x} is not in the list')
    table = '1Table' if flags & 0x200 else '0Table'
    print(f'  template: {bool(flags & 1)}, encrypted: {bool(flags & 0x100)}, picture: {bool(flags & 8)}, table stream: {table}')
    if table not in {e[0] for e in streams}: problems.append(f'{table} is missing')
    print('  problems:', '; '.join(problems) if problems else 'none found')
    return problems

if __name__ == '__main__':
    for p in sys.argv[1:]:
        try: check(p)
        except Exception as ex: print(f'  could not check: {ex}')

samples/full.doc: 66,048 bytes, starts d0 cf 11 e0 a1 b1 1a e1
  streams: '\x01CompObj', '\x01Ole', 1Table, Data, '\x05SummaryInformation', WordDocument, '\x05DocumentSummaryInformation'
  WordDocument: 11,837 bytes, wIdent 0xa5ec, nFib 0x0101
  template: False, encrypted: False, picture: True, table stream: 1Table
  problems: none found

We tried the script on all 44 test DOC files. It flagged none of the 9 Word files and 19 of the 25 damaged copies. It named the kind of the 8 renamed files and of the XLS and PPT files. It cannot see a flipped bit in the text or the tables, because those leave the structure intact. The section on damaged DOC files lists all 25.

damaged/d17-shifted.doc: 66,100 bytes, starts 58 2d 4d 61 69 6c 65 72
  signature found at offset 52: extra bytes come before the file

Four more clues about your DOC file

3 What Is Inside a DOC File? A header, tables, a directory and streams

Think of a filing cabinet with a card index. The header says where the index is. The index lists the drawers, which are called streams. Every drawer is a chain of 512-byte sheets, which are called sectors. Word opens the WordDocument drawer first, because its first bytes show Word what it is dealing with.

The sizes in the figure come from one file we built, with 40 paragraphs, a list, a table and a picture. The streams add up to 61,797 bytes. The rest of the DOC file is the header, the allocation table, the directory and padding to full sectors. Wikipedia on the Compound File Binary format says sectors are 512 or 4,096 bytes, and all our DOC files used 512.

The container header

We read these positions from our own files, and the script found no problem in any of our 9 good DOC files. Wikipedia and Microsoft Learn do not print them in the pages we could fetch. We read no header from a file made by Word.

The Word header at the start of WordDocument

Microsoft Learn says wIdent must be 0xA5EC. It says the bit named fEncrypted marks an encrypted or obfuscated document, and the bit named fWhichTblStm selects 1Table when it is 1 and 0Table when it is 0. In our full file the flag word was 12f8, with the table bit set. Our template read 12f9, and our password-protected file read 13f8.

The page for the Fib structure adds that nFib has five allowed values, and the rest of the header depends on which one it is. Word needs this header to find the text. When we set the first sector of WordDocument to zero, LibreOffice, antiword, catdoc and wvText all returned nothing. When we set only wIdent to zero, LibreOffice refused the DOC file, while antiword and wvText still returned all the text. The damage tests show the rest.

Where the text, the pictures and the names live

The text is stored in WordDocument. Microsoft says it is stored as 16-bit characters when the fCompressed bit is 0, and as 8-bit characters when the bit is 1, on the FcCompressed page. LibreOffice wrote our text as 16-bit characters, even for simple English. So you can see it with a text tool, but only if the tool reads 16-bit text.

The pictures are stored in the Data stream. Our 38,520-byte PNG was stored in one piece in a file that LibreOffice wrote, and the five lines below pulled it out with the same SHA-256 hash. We did not try this on a file made by Word, which may store pictures in other formats.

import olefile
data = olefile.OleFileIO('report.doc').openstream('Data').read()
start = data.find(b'\x89PNG\r\n\x1a\n')
end = data.find(b'IEND', start) + 8
open('picture.png', 'wb').write(data[start:end])

The author, title, comments and times are stored in the SummaryInformation stream. The section on safety shows how to read them.

4 Which Kind of DOC File Do You Have? Documents, templates and password-protected files

The ending .doc covers them all. A template gets the ending .dot, and PRONOM also lists .wbk, which Word uses for backup copies. Inside a DOC file, the kind is a set of bits in the flag word at bytes 10 and 11 of WordDocument.

We read the flag word of four files. Next to full.doc, every one of the other three differs by one bit, set for a picture, a template or encryption.

Microsoft Learn names the bits fDot, fHasPic and fEncrypted on the FibBase page. We matched them to the files by building one change at a time. The check script prints all three.

A picture means a Data stream

All four of our DOC files with pictures had a Data stream of 38,767 bytes, and none of the other five had one. A DOC file with no Data stream can still have pictures that Word draws itself, so use the bit as the proof and the stream as a hint.

Older Word formats

Wikipedia says Word for MS-DOS used its own DOC format, and the OLE-based format started with Word 97. PRONOM lists Word 6.0 and 95 files as the format before this one. We built none of them. If an old file fails every test on this page, open it in LibreOffice or Word and save it again as a new DOC or DOCX file.

12 What Else Looks Like a DOC File? .dot, .wbk, .docx and endings that mislead

The ending is a name that anyone can change. The Wikipedia entry shows the history, and the PRONOM record shows what a DOC file is: the container, the WordDocument stream and the text Word.Document.8. The table lists the endings that you may meet near .doc. We tested all but one.

Endings that mislead

We gave six other files the ending .doc. LibreOffice read all of them by content and returned all 52 items from every one. Neither antiword nor wvText returned anything from any of them. Catdoc and the text pass returned the text of the four plain text kinds, but not the two ZIP kinds.

The two other compound files, our XLS and PPT, were named by the check script as not Word files. A program that trusts the ending would try to read them as Word documents. A program that reads the stream names would not.

Other Word and Office formats

For spreadsheets and slides with the same first bytes, see the guide to XLS workbooks and the guide to PPT slides. Outlook messages use a compound file too, and the MSG file guide covers them. For Word files in the newer format, see the guide to Word DOCX files.

13 What Is the DOC File Format Made Of? The facts we could check, and what we left out

About the values we list

The positions and flag bits come from Microsoft Learn and from the files themselves. We checked them against files that five readers opened or refused in ways that matched. All of our DOC files came from LibreOffice 24.2.7 on Linux in October 2026. Word may write other values, so treat our numbers as guides, not promises.

The Wikipedia section on the specification says Microsoft released the DOC specification on February 15, 2008 under its Open Specification Promise, and that it does not cover all DOC features. So some tools still rely on reverse engineering. That fits what we saw: the tools disagreed on the same bad file.

What we left out

We did not test any DOC file made by Word. We also left out Fast Saved files, files with macros, Word 6 and 95 files and files with embedded objects. We did not use Word, Notepad, WordPad, Pages, Google Docs or WPS Office. Everything about them comes from Wikipedia, FileInfo and Microsoft.

The SysTools and Freeviewer tools come from their own pages, and we did not start either one. We name no prices. Their pages are not always consistent about free and paid features, so read the limits there.

Our damage tests are simple breaks in small files. We tried five readers, and others may behave differently. Our check script and repair script are research tools. Test them on copies before you trust them with anything that matters.

Sources checked

For the format and its history, see the Wikipedia article on DOC, the FileInfo page for the DOC ending and the PRONOM record fmt/40. For layout, see the MS-DOC specification, the FibBase page, the Fib page and the FcCompressed page. For damage and safety, see Microsoft on damaged documents, on blocked macros, on file block and on Document Inspector.

Every test count came from the 44 files and the scripts in our research folder.