What Is a PPT File? An Older PowerPoint Presentation, and How to Check One That Fails
A PPT file is a PowerPoint presentation in the older binary format, and four readers disagreed on 15 of the 21 damaged copies we made of one. Jump to your question below, or work through it in order.
What Is a PPT File? The older PowerPoint format, and a second meaning in a handheld game
Short answer
A PPT file is a PowerPoint presentation saved in the older binary format. It stores slides, text, pictures and notes in one compound file. Microsoft's MS-PPT specification covers PowerPoint 97, 2000, 2002 and 2003, and FileInfo names the type Microsoft PowerPoint Presentation (Legacy).
We read 127 PPT files from the Apache POI tests and damaged one of them in 21 ways. The file command named 124 of the 127 as PowerPoint. LibreOffice opened 117 and saved all 117 as PPTX with the same slide count. Our readers disagreed on 15 damaged copies, and 13 kinds of damage came back byte for byte.
To open one, read the open steps. To check one, read the check steps. If your PPT file will not open, begin with the eight causes.
A PPT file is a PowerPoint presentation saved in the older binary format that PowerPoint used from 1987 until PowerPoint 2007 added PPTX, per FileInfo. The ending also names a Sony game texture, so the first bytes show which one you have.
Picture a file called Presentation1.ppt that a colleague emailed and another that belongs to the data of an old PlayStation Portable game. Both end in .ppt. They share no format, no maker and no program.
FileInfo lists one PPT file type. It is the Microsoft PowerPoint Presentation (Legacy), an editable slide show with formatted text, pictures, movies and sound. FileInfo says Microsoft introduced the binary format in 1987 and that it stayed the main save format until PowerPoint 2007 brought PPTX.
File-extensions.org lists two PPT records. They are a Microsoft PowerPoint 97 to 2003 presentation and a Sony PlayStation Portable texture, which it marks obsolete. It also calls the PowerPoint record the Binary Interchange File Format. Microsoft titles its own specification PowerPoint (.ppt) Binary File Format, so we use that name.
We tested the PowerPoint kind and two close relatives. The Apache POI project on GitHub ships 146 PPT files as test data, and we read all of them. We also made one more file, a PPTX with a PPT name.
Where our PPT files come from
Apache POI is a Java project, and HSLF is its component for the binary PowerPoint format. Apache describes HSLF as a pure Java implementation that reads, creates and edits presentations from PowerPoint 97 to 2007.
The test data has 146 PPT files. 19 of them are fuzz test files, which the project builds to break readers. We call the other 127 regular PPT files. They are 9,684 to 3,333,632 bytes long and 40,520,664 bytes in total, and the median is 110,592 bytes.
We damaged one regular file in 21 ways, and every copy changes one thing. We worked on Linux with LibreOffice 24.2 and had no copy of PowerPoint, so we opened no file in PowerPoint.
PPT file facts at a glance
| Property | Value |
|---|---|
| Meaning | FileInfo lists the Microsoft PowerPoint Presentation (Legacy). File-extensions.org adds a Sony PlayStation Portable texture and marks it obsolete. |
| Ending | .ppt. Microsoft Support lists the newer endings .pptx, .pptm, .ppsx and .potx. |
| First bytes |
PowerPoint PPT files start with d0 cf 11 e0 a1 b1 1a e1, the signature of a compound file. All 127 of ours do.
|
| Container | A compound file in version 3 with sectors of 512 bytes. Microsoft publishes the container as MS-CFB and the presentation as MS-PPT. |
| Streams |
126 of our 127 PPT files contain streams named PowerPoint Document and Current User. 68 also contain a Pictures stream.
|
| Sizes | Our 127 regular PPT files are 9,684 to 3,333,632 bytes long, and the median is 110,592 bytes. |
| Opens with | PowerPoint, per FileInfo, plus Keynote, OpenOffice Impress and Google Slides. We tested file, 7-Zip, olefile, catppt, LibreOffice and our script on Linux. |
| Our tests | 127 regular PPT files, 21 damaged copies, 13 repairs checked on 115 files and 117 conversions to PPTX. |
Wrong page? A PPTX file starts with PK and is a different format. See how the neighbors differ.
Which Kind of PPT File Do You Have? Four questions, and the first bytes answer the first one
Four questions name the kind of a PPT file. Start with the first bytes. Every PowerPoint file we read starts with d0 cf 11 e0 a1 b1 1a e1, and a PPTX starts with 50 4b 03 04.
Work down the figure and stop at the first yes. We tested the first three rows with files. The last row rests on the page named in it, because we found no sample file.
The four kinds in detail
| Kind | Clue and source |
|---|---|
| PowerPoint presentation |
The first 8 bytes are the compound file signature and a stream is named PowerPoint Document. Microsoft says MS-PPT covers PowerPoint 97 to 2003. Tested on 126 regular PPT files.
|
| PPTX with a PPT name |
The first 4 bytes are 50 4b 03 04. The file command printed Microsoft PowerPoint 2007+, 7-Zip listed a ZIP package and LibreOffice opened it. Tested on one file we made.
|
| PowerPoint 4.0 |
A compound file with a stream named PP40 and none named PowerPoint Document. LibreOffice opened pp40only.ppt and made 87 pages. Tested on one file.
|
| PSP texture | File-extensions.org lists a Sony PlayStation Portable texture that a video game stores, and marks it obsolete. Source only. |
Start with the first bytes
Open the PPT file in a hex viewer or use xxd -l 16. If the first 8 bytes read d0 cf 11 e0 a1 b1 1a e1, the file is compound. If they read 50 4b 03 04, it is a ZIP package and so a PPTX.
The 8 byte signature also starts other compound files, like old Word and Excel files and MSG files. So it names the container and not the presentation. The file command goes further and printed application/ for 124 of our 127 regular PPT files.
Three regular PPT files got another answer. Two got application/ and one encrypted file got application/. So the file command is a good first reader, and it is not a final one.
PowerPoint Document points to PowerPoint 97 or later, and PP40 points to version 4.0.
Not sure your PPT file is a PowerPoint presentation at all? Check it with our script.
What Is Inside a PPT File? A container, a Current User stream and a document stream
PowerPoint PPT files are compound files with a 512 byte header, one directory, the Current User stream and the PowerPoint Document stream. Our example is 194,048 bytes long and has 5 saved edits.
We read PPT files because Microsoft publishes the layout and the Apache POI project ships examples, so every value can be checked. Two short commands show the first 16 bytes and name the type. We copied the example to a short name, example.ppt.
xxd -l 16 example.ppt
00000000: d0cf 11e0 a1b1 1ae1 0000 0000 0000 0000 ................
file -b example.ppt | cut -d, -f1-3
Composite Document File V2 Document, Little Endian, Os: Windows
file -b --mime-type example.ppt
application/vnd.ms-powerpoint
Bytes 0 to 7, d0 cf 11 e0 a1 b1 1a e1, are the signature of a compound file. The file command prints a longer line that adds the title, the author and the program stored in the file. We cut it to three fields.
The last line prints application/. IANA publishes a template page for that type. It is an email from 1996 that names the type Microsoft Powerpoint and calls it a generic label for the program. We could not read the full registry table, so we do not state its status.
The header, byte by byte
Bytes 24 and 25 give the minor version, 62, and bytes 26 and 27 give the major version, 3. Bytes 28 and 29, fe ff, mark low byte first order. Bytes 30 and 31 read 9, so a sector is 2 to the power of 9, or 512 bytes.
Bytes 44 to 47 give the count of FAT sectors, which is 3 here. Bytes 48 to 51 give the first directory sector, which is 374. Bytes 56 to 59 give the mini stream cutoff, 4,096. Streams below that size live in mini sectors of 64 bytes.
All 127 regular PPT files share the same sector size and cutoff. The minor version is 62 in 115 files and 59 in 12. Other values point to a version 4 file, which the container specification allows, or to damage.
The Current User stream
The stream named Current User is short. Ours has 47 bytes. Microsoft calls its one record the CurrentUserAtom, and it stores the last user name and the location of the most recent edit.
Bytes 12 to 15 are the header token, 5f c0 91 e3, which reads as 0xE391C05F. Microsoft says that value means the file should not be encrypted and 0xF3D1C4DF means it must be. Bytes 16 to 19 give the offset 170,190, counted from the start of the PowerPoint Document stream.
In 119 regular PPT files the token is 0xE391C05F, and in 5 it is 0xF3D1C4DF. The stream stores the last user name in clear text. Ours has 15 characters, so PPT files can show who saved them last.
The PowerPoint Document stream
Microsoft describes this stream as required and says new top level records, called a user edit, can be appended to it. Older records can then become obsolete.
Every record starts with an 8 byte header. A low nibble of 0xF in the first byte marks a container. Bytes 2 and 3 give the record type and bytes 4 to 7 give the length, per Apache POI.
The offset 170,190 lands on 00 00 f5 0f 1c 00 00 00, a record of type 0x0FF5 and length 28. That record is a UserEditAtom. Microsoft defines its offsetLastEdit field as the offset of the previous edit, with 0 meaning none. Ours stores 164,105, and following the links gave 5 edit records.
Across 118 regular PPT files the links read cleanly. 96 files have one edit record, 22 have two or more and 47261.ppt has 22. So PPT files can grow by adding to the stream, and older edits can stay inside them.
The parts of a PPT file
| Part | What it stores and what we saw |
|---|---|
| Header | 512 bytes with the signature, version 3, the sector size and the cutoff. The values were the same in all 127 regular PPT files. |
| Directory | A tree of storages and streams. Our example has the root and 5 streams. |
| Current User | The token, the offset of the newest edit and the last user name. 126 regular PPT files have it. |
| PowerPoint Document | The record tree with slides, notes, masters and edit records. Our example has 170,226 bytes and 51 records at the top level. |
| Pictures | Image data that the slides use. 68 regular PPT files have this stream, and ours has 15,081 bytes. |
| Summary streams |
The title, the author and the program name that the file command prints. 123 regular PPT files have SummaryInformation and 125 have DocumentSummary |
What the sources say
Microsoft publishes the PPT layout as MS-PPT, and its revision table shows revision 10.1 from 12 November 2024. It says the format is the binary format of PowerPoint 97, 2000, 2002 and Office PowerPoint 2003.
The container comes from a second document, MS-CFB on Microsoft Learn. We used both documents to name the fields, and every number on this page comes from our own files.
The map is small. Our script reads the header, the Current User stream and the newest edit record. It does not read slides, so damage inside a slide can pass it, as the 21 copies show.
What Did We Find in 127 PPT Files? Six readers, and they did not agree
We read 127 PPT files with six readers. The file command named 124, 7-Zip opened 126, olefile opened all 127, catppt returned text for 108 and LibreOffice opened 117. Our 24 line script passed 115 files, with 9 warnings and 3 flags.
All 127 files come from the Apache POI test data, so this is a study of one project and not a survey of every PPT file. We left out 19 fuzz test files, which we cover below, and we opened no file in PowerPoint.
Readers were file 5.45, 7-Zip 23.01, olefile 0.47, catppt from catdoc 0.95, LibreOffice 24.2.7.2 and our own script on Python 3.13, all on Linux. A reader passed a PPT file when it returned data without an error.
| Test | Result |
|---|---|
| The file command |
Printed application/ for 124 of 127. Two files got application/ and one encrypted file got application/. It printed Composite Document File V2 for 126 files and CDFV2 Encrypted for the other.
|
| 7-Zip | Opened 126 files as a Compound archive and listed the raw streams. It refused one regular file, which also ends in a tail of 468 bytes that fills no sector. We did not find the cause. |
| olefile | Opened all 127 files and listed their streams, including the 5 encrypted files. |
| catppt | Returned text for 108 files and nothing for 19. Five of the 19 are the encrypted files, and 14 are other files, like empty.ppt. |
| LibreOffice | Saved 117 files as PDF. It refused 10 with the message source file could not be loaded. Five are the encrypted files, and 5 pass our script. We did not find out why. |
| Our script | Printed OK for 115 files, WARN for 9 and FLAG for 3. The warnings are 5 encrypted files and 4 files with a tail that does not fill a sector. LibreOffice opened all 3 flagged files. |
| Sizes | 9,684 to 3,333,632 bytes, with a median of 110,592 and a total of 40,520,664. |
| Edit records | 22 of 118 files store more than one edit record. The most is 22, in 47261.ppt. |
One container and 127 PPT files
Every regular PPT file starts with the compound file signature and uses version 3. All 127 use sectors of 512 bytes, mini sectors of 64 bytes and a mini stream cutoff of 4,096. The minor version is 62 in 115 files and 59 in 12.
126 files contain the PowerPoint Document and Current User streams, and 68 contain the Pictures stream. The one file without that stream is pp40only.ppt, which has a stream named PP40. 123 files have a SummaryInformation stream.
The file command prints the program name stored in the PPT file. It printed Microsoft Office PowerPoint for 47 files, Microsoft PowerPoint for 46, PowerPoint 4.0 for 5, Macintosh PowerPoint for 4 and PowerPoint 7.0 for 3. The other 22 files store no name.
Where readers split on regular PPT files
The 5 encrypted files and 5 other files split the readers. LibreOffice refused all 10. 7-Zip and olefile listed the streams of the 5 encrypted files, because the container is intact, and catppt returned nothing for them.
Three regular PPT files that LibreOffice opened got a FLAG from our script. PPT95.ppt has a Current User stream of 15 bytes. bug56240.ppt has a Current User record of type 0x0000 and an extra storage named PP97_DUALSTORAGE. pp40only.ppt has no PowerPoint Document stream.
The 19 fuzz test files
The 19 fuzz test PPT files behave in another way. The file command named 13 as compound files, 7-Zip opened 8 and olefile opened 18. catppt returned text for 2 and LibreOffice opened 3. Our script printed OK for 3, WARN for 2 and FLAG for 14.
Macros, encryption and pictures
We looked for VBA code with olevba 0.60.2 from oletools. It found VBA code in 3 regular PPT files, 59302.ppt, SimpleMacro.ppt and WithMacros.ppt. 5 files use the encrypted token, and 68 contain a Pictures stream.
Read the study with care. It shows what six readers do with 127 PPT files from one project. Files from other programs and versions can differ, and we had no copy of PowerPoint to save our own.
What Happens When a PPT File Is Damaged? 21 broken copies, and the readers disagreed on 15
We damaged one PPT file in 21 ways. The four readers that return data disagreed on 15 copies, and none of them matched the original on 10. Our script flagged or warned on 17, and 13 kinds of damage came back byte for byte.
The 21 copies come in three groups of 7. Group A changes the container header. Group B changes the length of the PPT file or how it was moved. Group C changes a pointer, a stream name or the data. Every copy changes one thing in example.ppt, which is 194,048 bytes long.
We asked three questions about every copy. What did every reader return, compared with its answer on the original? Did our script flag it? And did one command restore the original, checked by SHA-256 on the 115 regular PPT files that our script passes?
Four copies, four different answers
A2 changes the byte order mark of the PPT file. 7-Zip refused it, while olefile, catppt and LibreOffice returned the original data. B1 cuts the last byte. 7-Zip and olefile returned different data, while catppt and LibreOffice matched the original.
C2 raises the edit offset by one. catppt matched the original, 7-Zip and olefile returned different data and LibreOffice refused it. A4 sets the version to 5. 7-Zip and LibreOffice refused it, and olefile and catppt matched.
So no reader works as judge of the others. A refusal warns you that something is wrong. Any reader that returns different data says nothing, and 7-Zip or olefile did that on 12 of the 21 copies. Both list raw streams, so a changed byte always shows.
The two readers that return text behaved better. catppt and LibreOffice never returned different text. On every copy they matched the original or refused it.
The 17 copies our script flagged or warned on
A1 changes a byte of the signature and B6 removes the first byte, so neither starts with the signature. The script names that for both. A2 and A4 change the byte order mark and the version, and the script names both as one header problem.
A3, B2 and B3 break the directory, so the script prints a directory error. A5, B5, C5 and C7 leave the container open but hide the PowerPoint Document stream. C4 renames Current User, and the script reports that stream missing.
C2 moves the edit offset by one and the script reports no edit record at that offset. C6 zeroes a FAT sector and gets the same message. B7 cuts the last sector, and the script says Current User is too short.
C3 marks the file encrypted and B1 leaves a tail that fills no sector, so both get only a warning. That warning is weak, because 4 healthy regular PPT files have a tail too.
The 4 copies our script passed
A6 sets the FAT sector count to 0 and A7 sets the mini stream cutoff to 0. B4 adds 512 zero bytes and C1 flips one bit. All four keep a header, a Current User stream and an edit record that the script accepts.
B4 is harmless, because every reader returned the data of the original PPT file. A6 reads as the original in the file command and olefile, but 7-Zip, catppt and LibreOffice refused it. A7 made LibreOffice refuse it and 7-Zip print different data. C1 made 7-Zip and olefile return different data.
A pass means the container header is sound and not that the presentation opens. Three of the four passed copies still failed or differed in at least one reader.
Repairs that worked
We wrote one command per kind of damage, 13 in all, and tested it on the 115 regular PPT files that our script passes. A hash matched the original for every kind. Twelve kinds worked on all 115 files.
A5 worked on 107 of 107 PPT files. In the other 8 files the directory already starts at sector 0, so the damage changes nothing. Our first version took the first match and failed on 16 of the 107, because older saves leave a copy of the directory behind.
C2 writes back the offset of the last edit record before the wrong one. C3 writes the not encrypted token back, so use it only when you know the file was not encrypted. B5 mimics a text mode copy.
Every repair fits a case where one thing is wrong. Damage in the wild changes many things at once, so a repair that works here can fail there.
What no command repaired
B1, B2, B3 and B7 cut the PPT file. C1 flips a bit, C6 zeroes a FAT sector and C7 zeroes half of the file. Cut and zeroed data is gone, and no header brings it back. We tested no repair for those 7 copies. B4 needs none.
Read the grid with care. Every copy changes one thing in one PPT file. Damage in the wild changes many things at once. We opened no copy in PowerPoint, and our repairs rely on rules that fit these 115 regular PPT files.
What Does Our Expert Say About PPT Files? A note from Neeraj Singh on trusting one reader
Compare two readers before you trust one. Our four readers disagreed on 15 of 21 damaged copies, so one reader that opens a PPT file proves little.
Expert insight
“A PPT file is a container, and our readers gave different answers on the same damaged copy. In our test only one of 21 copies read the same in every tool. Compare two readers, keep the original and write down its hash before you repair anything.”
Why one reader is not enough
Raw readers can return different data without an error. 7-Zip or olefile did that on 12 of our 21 copies, and neither printed a warning. A refusal at least warns you that something is wrong.
We had no copy of PowerPoint. If PowerPoint opens your PPT file, treat that as the best test. Use the readers on this page when it does not. catppt and LibreOffice matched or refused on every copy, so they make better second readers than a raw lister.
Copy your PPT file before you repair it. Work on the copy and keep the original untouched. Write down its SHA-256 hash first, so you can show later that the copy came back as it was.
How Do You Open a PPT File? PowerPoint first, then free programs and Linux tools
FileInfo names PowerPoint as the best program for a PPT file, and lists Keynote, OpenOffice Impress and Google Slides too. We opened none in PowerPoint, and LibreOffice opened 117 of our 127 regular PPT files on Linux.
The table lists what the sources name and what we tested. Rows with version numbers are tools we tested. Every other row rests on the page named in it, and we tested none of those.
| Program | What it does |
|---|---|
| Microsoft PowerPoint | FileInfo says PowerPoint is the best application for PPT files, because it fully supports the formatting. It lists PowerPoint 365 for Windows and Mac and apps for iOS and Android. We did not test it. |
| PowerPoint Viewer | File-extensions.org lists Microsoft PowerPoint Viewer and Documents To Go for Windows, and Microsoft Office Mobile for Android, as viewers. We tested none of them. |
| Keynote and Preview | FileInfo lists Apple Keynote and Apple Preview for Mac. File-extensions.org lists Keynote for Mac and iOS. We tested none of them. |
| OpenOffice Impress | Both sources list it for Windows, Mac and Linux. We did not test it. |
| Google Slides | FileInfo says Google Slides lets you upload a PPT file to view, edit, save or convert it. We did not test it, and a web viewer receives your file. |
| LibreOffice | Version 24.2.7.2 from the command line. It saved 117 of 127 regular PPT files as PDF and as PPTX. |
| 7-Zip | Version 23.01. It opened 126 of 127 regular PPT files as a Compound archive and listed their streams. It shows raw parts and not slides. |
| olefile | Version 0.47. A Python library that opened all 127 regular PPT files and listed their streams. |
| catppt | Version 0.95 from the catdoc package. A text extractor that returned text for 108 of 127 regular PPT files. |
| The file command | Version 5.45. It printed the PowerPoint type for 124 of 127 regular PPT files. |
Open a PPT file on Linux
file -b example.ppt | cut -d, -f1-3
Composite Document File V2 Document, Little Endian, Os: Windows
7z l example.ppt (abridged)
452 512 [5]SummaryInformation
15081 15360 Pictures
47 64 Current User
1708 1728 [5]DocumentSummaryInformation
170226 170496 PowerPoint Document
python3 -c "import olefile; print(olefile.OleFileIO('example.ppt').get_metadata().title.decode())"
ROMANCE: AN ANALYSISThe file command names the type, and 7-Zip lists the raw streams. The olefile library prints the title from the summary stream, which shows that a reader understands part of the file and not only the container.
Open it in LibreOffice without a window
LibreOffice reads PPT files and writes PDF or PPTX from the command line. We used the same two commands on every regular file. The LibreOffice site has the program, and the second command counts slides with python-pptx.
soffice --headless --convert-to pdf example.ppt
soffice --headless --convert-to pptx example.pptWhat to use for every kind
PowerPoint presentations. If PowerPoint is installed, open the PPT file there. Without it, use a program from the table, or read the streams with olefile as shown above.
PPTX with a PPT name. Rename the file to .pptx and open it in a presentation program. LibreOffice opened the one we made without a rename.
PSP textures. We found no sample and no modern program. Read the first bytes and the source page first.
Install programs from their makers. Take PowerPoint from Microsoft and other programs from their own pages. A free site that offers to open any PPT file receives your slides, so try the steps on this page first.
How Do You Check a PPT File? Six steps and a script of 24 lines
Check a PPT file in six steps. Read the first 16 bytes, name the type, use a script and compare two readers. Our 24 line script passed 115 of 127 regular PPT files and flagged or warned on 17 of 21 damaged copies.
First reads need no Python. The xxd command prints bytes, and wc prints the length. In a healthy compound file the length minus 512 divides by 512, and 194,048 does.
xxd -l 16 example.ppt
00000000: d0cf 11e0 a1b1 1ae1 0000 0000 0000 0000 ................
wc -c < example.ppt
194048Read the first line from the left. Bytes 0 to 7 are the signature. The length, 194,048 minus 512, leaves 193,536, which is 378 sectors of 512 bytes. Four of our regular PPT files end in a tail, so a remainder is a warning and not proof of damage.
Check PPT files with Python
The script reads the signature, the version and the byte order of a PPT file. It opens the container with olefile and looks for the PowerPoint Document and Current User streams. It reads the token and the offset from Current User.
It then checks that a record of type 0x0FF5 starts at that offset in the PowerPoint Document stream. It prints the tail check, then OK, WARN or FLAG. It never changes a file.
import sys, struct, olefile
def peek(path):
b = open(path, 'rb').read()
if b[:8] != bytes.fromhex('d0cf11e0a1b11ae1'): return 'FLAG', 'start is not D0CF11E0A1B11AE1'
major, bo, ss = struct.unpack('<HHH', b[26:32])
if major not in (3, 4) or bo != 0xFFFE: return 'FLAG', 'CFB version or byte order'
tail = (len(b) - 512) % (1 << ss)
o = olefile.OleFileIO(b)
if not o.exists('PowerPoint Document'): return 'FLAG', 'no PowerPoint Document stream'
if not o.exists('Current User'): return 'FLAG', 'no Current User stream'
cu = o.openstream('Current User').read()
if len(cu) < 20: return 'FLAG', 'Current User too short'
rtype, rlen, size, token, off = struct.unpack('<2xHIIII', cu[:20])
if rtype != 0xFF6: return 'FLAG', 'Current User record type'
if token not in (0xE391C05F, 0xF3D1C4DF): return 'FLAG', 'Current User token'
d = o.openstream('PowerPoint Document').read()
if off + 8 > len(d): return 'FLAG', 'edit offset past the stream'
if struct.unpack('<H', d[off + 2:off + 4])[0] != 0xFF5: return 'FLAG', 'no edit record at offset'
enc = token == 0xF3D1C4DF
return ('WARN' if tail or enc else 'OK'), '%s, stream %d bytes, %d bytes%s' % ('encrypted' if enc else 'not encrypted', len(d), len(b), ', %d byte tail' % tail if tail else '')
for f in sys.argv[1:]:
try: r, why = peek(f)
except Exception as e: r, why = 'FLAG', 'directory: ' + type(e).__name__
print(r, why, f)Here is what it printed for four healthy PPT files. They are an empty presentation, a small one, our example and a large file of 3,333,632 bytes.
python3 ppt_peek.py empty.ppt bullets.ppt example.ppt customGeo.ppt
OK not encrypted, stream 3233 bytes, 10240 bytes empty.ppt
OK not encrypted, stream 12807 bytes, 18944 bytes bullets.ppt
OK not encrypted, stream 170226 bytes, 194048 bytes example.ppt
OK not encrypted, stream 965630 bytes, 3333632 bytes customGeo.pptEvery answer starts with OK, WARN or FLAG. A healthy answer then says whether the file is encrypted and gives the stream size, the file size and the file name.
python3 ppt_peek.py A1_signature_changed.ppt A3_sector_shift_12.ppt B2_cut_to_half.ppt B5_crlf_text_mode.ppt C1_bit_flip.ppt C2_edit_offset_plus1.ppt
FLAG start is not D0CF11E0A1B11AE1 A1_signature_changed.ppt
FLAG directory: OleFileError A3_sector_shift_12.ppt
FLAG directory: OleFileError B2_cut_to_half.ppt
FLAG no PowerPoint Document stream B5_crlf_text_mode.ppt
OK not encrypted, stream 170226 bytes, 194048 bytes C1_bit_flip.ppt
FLAG no edit record at offset C2_edit_offset_plus1.pptA1 does not start with the signature. A3 and B2 give a directory error. B5 shows no PowerPoint Document stream, and C2 stores an offset that no longer lands on an edit record. C1 passes, because its flipped bit lies outside the parts the script reads.
What the script found in our PPT files
| Result | Cases |
|---|---|
| Passed (115 regular PPT files) | The signature, version and byte order are right, both streams exist, the token is valid and a record of type 0x0FF5 starts at the stored offset. |
| Warned (9 regular PPT files, B1, C3) | Five files use the encrypted token and four end in a tail that does not fill a sector. The cut B1 and the encrypted token C3 get the same warnings. |
| Flagged but healthy (3 regular PPT files) | PPT95.ppt has a short Current User stream, bug56240.ppt has a record of type 0x0000 and pp40only.ppt has no PowerPoint Document stream. LibreOffice opened all three. |
| Start is not the signature (A1, B6) | A changed byte in the signature or a lost first byte. Both flagged. |
| Header fields (A2, A3, A4) | A2 and A4 print CFB version or byte order. A3 prints a directory error. |
| Missing streams (A5, B5, C4, C5, C7) | The container opens and the script cannot find Current User or PowerPoint Document. |
| Cuts and pointers (B2, B3, B7, C2, C6) | B2 and B3 print a directory error. B7 prints a short Current User stream. C2 and C6 print that no edit record starts at the offset. |
| Passed (A6, A7, B4, C1) | The header, the pointer and the edit record are sound, so the script passes them. B4 is harmless. The other three fail or differ in at least one reader. |
The script has limits. It does not read slides, so it passes A6, A7, B4 and C1. It flags 3 healthy older PPT files, so a flag is a reason to look closer and not a verdict. It repairs nothing. The repair commands fix the 13 kinds of damage we tested.
Check order for any PPT file
- Copy your PPT file, write its SHA256 hash and work on the copy.
-
Read the first 16 bytes. The signature
d0 cf 11 e0 a1 b1 1a e1means a compound file, and50 4b 03 04means a ZIP package. See the list of kinds. -
Name the type with the file command.
application/is the answer you want. A longer name like Composite Document File V2 Document means a compound file of another kind or one it cannot read inside.vnd .ms-powerpoint - Use our script. The first word is OK, WARN or FLAG, and a flag names the part where the PPT file stops making sense.
- List the streams with 7-Zip or olefile and extract the text with catppt or LibreOffice. Compare at least two readers, because one reader can return wrong data without an error.
- Ask the sender for the PPT file again or for its hash. Only PowerPoint shows whether a presentation displays, and we tested none.
Is a PPT File Safe to Open? Reading is safe, and macros need care
Reading the bytes of a PPT file starts nothing, so it is safe. Treat macros with care, because PPT files can contain them and 3 of our 127 regular PPT files do. A PPTX cannot.
We started no macro. Our readers only read bytes, and the files are public test data from the Apache POI project. We scanned none for malware, but we did look for VBA code with olevba from oletools.
Microsoft Support lists the Open XML presentation endings and says files with an x ending cannot contain macros. PPT files have no x, so they can contain them. The same page lists .pptm for a presentation with macros.
Encrypted PPT files
5 of our regular PPT files use the encrypted token, which Microsoft says means the file must be encrypted. 7-Zip and olefile listed all 5, because the container is intact. LibreOffice refused all 5 and catppt returned nothing. We tried no password.
A name inside the file
The Current User stream stores the name of the last user in clear text. The SummaryInformation stream stores an author and a last saved by field, which the file command prints. Check both before you share a PPT file, because the names travel with it.
PPTX files with a PPT name
Renamed PPTX files are ZIP packages. 7-Zip listed ours as one, and our script flagged the signature. Read the first 4 bytes before you trust either ending.
A presentation from a stranger
Open the PPT file in a viewer with macros off. Check the sender and the file name before you click any link in the slides.
Not sure? Check it first. Copy the hash, read the first bytes with our check steps and ask the sender where the PPT file came from. Open it last.
Why Will Your PPT File Not Open? Eight causes, and what to do about every one
Most PPT files that will not open fail for one of eight reasons. Read the first bytes, name the type and use the script. Our script flagged or warned on 17 of 21 damaged copies, and 13 kinds of damage came back byte for byte.
We damaged one PPT file in 21 ways and tested repairs on every healthy PPT file where the damage changes bytes. The table groups what we saw into eight causes.
Every row says what happens to your PPT file and what to try. Fixes work on copies, and none changes the original. We opened no repaired file in PowerPoint, so a repaired container shows only that the container is sound.
| Cause | Result and fix |
|---|---|
| The wrong kind of file (1) |
The file does not start with d0 cf 11 e0 a1 b1 1a e1. Renamed PPTX files start with 50 4b 03 04, and our script flagged the start of the one we made. Fix: Find the kind in the kind chart. Rename a ZIP package to .pptx and open it in a presentation program.
|
| A signature that is changed or lost (2) |
A1 changes the first byte of the signature and B6 loses it. Our script flagged both. Fix: Write d0 cf 11 e0 a1 b1 1a e1 over bytes 0 to 7, or put the lost byte d0 back in front. Both came back byte for byte on all 115 files.
|
| A header field that is wrong (3) |
A2 changes the byte order, A3 the sector size, A4 the version, A5 the first directory sector, A6 the FAT sector count and A7 the cutoff. Fix: Write fe ff at bytes 28 and 29, 9 at bytes 30 and 31 and 3 at bytes 26 and 27. Find the root entry for A5, count the FAT sectors for A6 and write 4,096 at bytes 56 to 59 for A7. All six came back byte for byte.
|
| A copy made in text mode (4) | B5 replaces every newline byte 0a with 0d 0a, so the PPT file grows. Fix: Replace every 0d 0a with 0a. It worked on all 115 files. Use binary mode for transfers from now on. |
| A pointer or a token that is wrong (5) |
C2 adds one to the edit offset in Current User, so it no longer lands on an edit record. C3 sets the token to the encrypted value. Fix: For C2, write back the offset of the last edit record before the wrong one. For C3, write 5f c0 91 e3 only if you know the file was not encrypted. Five of our regular PPT files use the encrypted token on purpose, so leave those alone.
|
| A stream name that is changed (6) |
C4 renames Current User and C5 renames PowerPoint Document, so readers cannot find them. Fix: Write the first letters back, C for Current User and P for PowerPoint Document. Both came back on all 115 files.
|
| A file that is cut (7) | B1, B2, B3 and B7 cut the PPT file. Our script warned on B1 and flagged the other three. Fix: Ask for a new copy. We tested no repair. B4 adds zero bytes at the end and needs none. |
| Data that is zeroed or flipped (8) | C1 flips one bit, C6 zeroes one FAT sector and C7 zeroes half of the PPT file. Our script flagged C6 and C7 and passed C1. Fix: Ask for a fresh copy or backup. We tested no repair. |
Repairs we tested
One short script covers all 13 fixes. It takes the damaged file, one kind code and a name for the new file. The commands after it are the ones we used, with short file names.
import struct, olefile
SIG = bytes.fromhex('d0cf11e0a1b11ae1')
def pos(b, name):
o = olefile.OleFileIO(bytes(b)); e = o.direntries[o._find(name)]; chain = []; s = o.root.isectStart
while s < 0xFFFFFFFA: chain.append(s); s = o.fat[s]
if e.size >= 4096: return (e.isectStart + 1) * 512
m = e.isectStart * 64; return (chain[m // 512] + 1) * 512 + m % 512
def fix(b, how):
b = bytearray(b)
if how == 'A1': b[:8] = SIG
elif how == 'A2': b[28:30] = b'\xfe\xff'
elif how == 'A3': b[30:32] = struct.pack('<H', 9 if b[26] == 3 else 12)
elif how == 'A4': b[26:28] = struct.pack('<H', 3 if b[30] == 9 else 4)
elif how == 'A5':
cands = [s for s in range((len(b) - 512) // 512) if b[512 + s * 512 + 66] == 5 and 2 <= struct.unpack('<H', b[512 + s * 512 + 64:512 + s * 512 + 66])[0] <= 64]
for s in reversed(cands):
t = bytearray(b); t[48:52] = struct.pack('<I', s)
try:
if olefile.OleFileIO(bytes(t)).exists('PowerPoint Document'): b = t; break
except Exception: pass
elif how == 'A6': b[44:48] = struct.pack('<I', sum(s < 0xFFFFFFFA for s in struct.unpack('<109I', b[76:512])))
elif how == 'A7': b[56:60] = struct.pack('<I', 4096)
elif how == 'B5': b = bytearray(bytes(b).replace(b'\r\n', b'\n'))
elif how == 'B6': b = bytearray(b'\xd0') + b
elif how == 'C2':
o = olefile.OleFileIO(bytes(b)); d = o.openstream('PowerPoint Document').read(); p = pos(b, 'Current User')
off = struct.unpack('<I', b[p + 16:p + 20])[0]; b[p + 16:p + 20] = struct.pack('<I', d.rfind(b'\x00\x00\xf5\x0f', 0, off + 4))
elif how == 'C3': p = pos(b, 'Current User'); b[p + 12:p + 16] = struct.pack('<I', 0xE391C05F)
elif how == 'C4': b = bytearray(bytes(b).replace('Xurrent User'.encode('utf-16le'), 'Current User'.encode('utf-16le')))
elif how == 'C5': b = bytearray(bytes(b).replace('XowerPoint Document'.encode('utf-16le'), 'PowerPoint Document'.encode('utf-16le')))
return bytes(b)
if __name__ == '__main__':
import sys
open(sys.argv[3], 'wb').write(fix(open(sys.argv[1], 'rb').read(), sys.argv[2]))# 2 signature changed (A1), first byte lost (B6)
python3 ppt_fix.py A1_signature_changed.ppt A1 A1_fixed.ppt
python3 ppt_fix.py B6_first_byte_lost.ppt B6 B6_fixed.ppt
# 3 header fields (A2 to A7 work the same way)
python3 ppt_fix.py A5_dir_sector_0.ppt A5 A5_fixed.ppt
# 4 text mode copy (B5)
python3 ppt_fix.py B5_crlf_text_mode.ppt B5 B5_fixed.ppt
# 5 edit offset wrong (C2), token wrong (C3)
python3 ppt_fix.py C2_edit_offset_plus1.ppt C2 C2_fixed.ppt
# 6 stream names changed (C4, C5)
python3 ppt_fix.py C4_current_user_renamed.ppt C4 C4_fixed.ppt
# compare with the original
sha256sum example.ppt A1_fixed.ppt B5_fixed.ppt C2_fixed.ppt | cut -c1-12
b20e64554aed
b20e64554aed
b20e64554aed
b20e64554aedThe last lines compare hashes. The first 12 characters match for the original and the three repaired files, so the repaired files equal the original. Apply only the fix that matches the flag.
Check PPT files that will not open, step by step
We tested the steps on Python 3.13 and Linux. We opened no files in PowerPoint, and the steps keep the original untouched at every point.
- Copy your PPT file, write its SHA256 hash and work on the copy.
-
Name the type with the file command and the four kind questions. Only PowerPoint files start with the compound file signature and contain a stream named
PowerPoint Document. - Use our check script. A flag names the part where your PPT file stops making sense.
- Match the flag to a cause in the table above and try its fix on the copy.
- Compare the SHA256 hash of the result with the source if you can get one, and open the result in two readers.
- If one fix fails, do not stack another on top. Go back to the copy and try the next cause.
- Open the repaired file in PowerPoint. We tested none, so a repaired container is no proof that the slides display.
What to send a helper
Short messages get faster answers. Include the details below and add the script output. Its first word gives OK, WARN or FLAG.
Subject: PPT file will not open
File: name, size in bytes and SHA256 hash
Kind: the output of the file command
Check: the output of ppt_peek.py
Program: name, version and the exact words of the error
Source: who sent the PPT file and when it was copiedWhat no step can fix
Do not try online repair sites. Sites that offer to fix or convert any PPT file receive your upload. A presentation can contain private plans and figures. Try the steps above on a copy first.
Can You Convert a PPT File? Yes, to PPTX and PDF, and the slide count matched
LibreOffice converted 117 of 127 regular PPT files to PPTX, and python-pptx opened all 117. The 1,123 slides matched the PDF page counts for every file. We did not compare text, pictures or layout, so check the result in PowerPoint.
Conversion is a common reason to open PPT files. FileInfo says Google Slides lets you upload and convert PPT files, and LibreOffice writes PDF and PPTX from the command line.
A test with LibreOffice
We converted every regular PPT file to PPTX with LibreOffice 24.2.7.2. It wrote a PPTX for 117 of 127 files and refused 10. Five of the ten are the encrypted files, and five pass our script.
We opened every PPTX with python-pptx library and counted the slides. All 117 opened, and the counts add up to 1,123 slides. The largest file, bug56240.ppt, has 105. Every count matched the number of pages in the PDF that LibreOffice wrote for the same file.
soffice --headless --convert-to pptx example.ppt
python3 -c "from pptx import Presentation; print(len(Presentation('example.pptx').slides))"
# prints
14The example PPT file has 14 slides, and LibreOffice also made 14 pages from it. A matching count shows that no slide went missing. It does not show that text, fonts, pictures or animations came across, and we checked none of them.
The files LibreOffice refused
The 10 refusals are the same 10 files that LibreOffice could not save as PDF. We did not find the cause for the five that pass our script. Try PowerPoint or another reader on them, and keep the PPT file.
What every target is for
Keep the original file. Convert a copy and keep the PPT file you have. Page through every slide of the result before you delete anything, because matching slide counts do not prove a faithful copy.
How Does a PPT File Differ From PPTX, DOC and MSG Files? Close neighbors, and only one contains a PowerPoint Document stream
PPT files have close neighbors. PPTX files are ZIP packages, DOC and XLS files share the compound file signature and MSG files are Outlook items. Only PPT files contain a stream named PowerPoint Document.
Several kinds of file get mixed up with PPT files because they come from Office. The table lists them next to PPT. Every row ends with its source.
| Type | What separates it |
|---|---|
| PPT |
A compound file that starts with d0 cf 11 e0 a1 b1 1a e1. It stores slides, text and pictures in streams, and PowerPoint 97 to 2003 write it. Source: Our tests and Microsoft.
|
| PPTX |
A ZIP package that starts with 50 4b 03 04. Microsoft Support says files with an x ending cannot contain macros. Source: Our tests and Microsoft Support.
|
| PPTM, PPSX and POTX | Other Open XML endings for presentations with macros, slide shows and templates. Source: Microsoft Support. |
| DOC | The older Word format. Its first 8 bytes match PPT files, because it is a compound file too. Source: Our DOC page. |
| XLS | The older Excel format. It also begins with the compound file signature. Source: Our XLS page. |
| MSG |
An Outlook item in a compound file. Its streams differ from PPT files, because it has a stream named __properties_version1.0. Source: Our MSG page.
|
| A document for reading or printing. LibreOffice wrote one for 117 of our PPT files. Source: Our tests. |
PPT or PPTX
PPT files are compound files and PPTX files are ZIP packages, so the first bytes separate them. FileInfo says the binary format stayed the main save format until PowerPoint 2007 brought PPTX. Our test converted 117 PPT files to PPTX.
PPT or DOC and XLS
All three begin with the compound file signature, so the first 8 bytes name the container and not the program. The stream names separate them. PPT files contain PowerPoint Document and Current User, and the file command names the type.
PPT or MSG
An MSG file stores one Outlook item and PPT files store presentations. Both are compound files. An MSG file stores properties in a stream named __properties_version1.0, per our tests of 41 MSG files.
Which one do you have
What Is the PPT File Format Made Of? The facts we could check, and where they came from
PPT is an ending that more than one maker used. Facts below come from our own checks of 127 PPT files and 21 damaged copies. Sources are FileInfo, file-extensions.org, Microsoft, Apache POI and IANA.
| Part | What we could check |
|---|---|
| Maker | Microsoft for the PowerPoint kind, per FileInfo, which says Microsoft introduced the format in 1987. File-extensions.org marks the Sony kind as obsolete. |
| Name | FileInfo lists Microsoft PowerPoint Presentation (Legacy). File-extensions.org lists a Microsoft PowerPoint 97 to 2003 presentation and a Sony PlayStation Portable texture. Microsoft titles its specification PowerPoint (.ppt) Binary File Format. |
| First bytes |
PowerPoint PPT files start with d0 cf 11 e0 a1 b1 1a e1, as our 127 regular PPT files show.
|
| Container | A compound file. Our files use version 3, sectors of 512 bytes, mini sectors of 64 bytes and a mini stream cutoff of 4,096. |
| Streams |
PowerPoint Document and Current User in 126 files, Pictures in 68, SummaryInformation in 123 and DocumentSummary |
| Records | Every record starts with an 8 byte header. Current User stores a record of type 0x0FF6, and every saved edit adds a record of type 0x0FF5. |
| Encryption | A token in Current User. 0xE391C05F means the file should not be encrypted and 0xF3D1C4DF means it must be. 119 of our files use the first and 5 use the second. |
| Sizes | Our files are 9,684 to 3,333,632 bytes long, and the median is 110,592 bytes. We have no size data for other kinds. |
| Specification | Microsoft publishes MS-PPT, revision 10.1 from 12 November 2024, for PowerPoint 97, 2000, 2002 and Office PowerPoint 2003, and MS-CFB for the container. |
| Media type | The file command prints application/vnd.ms-powerpoint for 124 of 127 files. IANA publishes a template page for that type. We did not read the registry row, so we state no status. |
| Our tests | 127 regular PPT files, 21 damaged copies, 6 readers and 13 repairs. The file command, 7-Zip, olefile, catppt, LibreOffice and a 24 line script all read our PPT files on Linux. |
About the values we list
Facts about the layout come from our own reading of 127 PPT files and from the Microsoft documents. Facts about the other kinds come from the pages we name, and we did not test them.
Where we found no record, we say so. We found no sample of the PlayStation Portable kind, and we read no registry row for the media type.
What we left out
We opened no PPT file in PowerPoint, Keynote, Google Slides or a web viewer. We had no sample of a PlayStation Portable texture. We scanned no file for malware, and we tried no password on an encrypted file.
All 127 regular PPT files come from the Apache POI tests, and 19 more are fuzz test files that we kept apart. Our damaged copies come from one PPT file and change one thing at a time. Files saved by other versions of PowerPoint can differ from ours.
Sources checked
For the kinds, see the FileInfo page on PPT files and the file-extensions.org PPT list. For the layout, see the MS-PPT specification and the MS-CFB specification.
For the media type, see the IANA media types registry. For the endings that go with PPTX, see the Microsoft note on Open XML formats.
For the readers, see the Apache POI HSLF component, olefile on GitHub and LibreOffice. Every count on this page came from files and scripts in our research folder.
Frequently Asked Questions About PPT Files
What is a PPT file?
A PPT file is a PowerPoint presentation saved in the older binary format. FileInfo says Microsoft introduced it in 1987. PowerPoint PPT files start with the bytes d0 cf 11 e0 a1 b1 1a e1. The same ending also names a Sony PlayStation Portable texture.
How do I open a PPT file?
Open it in PowerPoint if you have it. FileInfo also lists Apple Keynote, OpenOffice Impress and Google Slides. On Linux we read 127 PPT files with the file command, 7-Zip, olefile, catppt and LibreOffice, and LibreOffice opened 117.
How do I open a PPT file without PowerPoint?
Try Keynote on a Mac, OpenOffice Impress or Google Slides. LibreOffice opened 117 of our 127 regular PPT files and saved them as PDF. You can also read the streams with olefile, which opened all 127.
Is a PPT file safe to open?
Reading the bytes starts nothing, so reading is safe. PPT files can contain macros, and olevba found VBA code in 3 of our 127 regular PPT files. Microsoft Support says files with an x ending cannot contain macros. Open PPT files from strangers with macros off.
What is the difference between PPT and PPTX?
PPT files are compound files and PPTX files are ZIP packages. A PPT file starts with d0 cf 11 e0 and a PPTX starts with 50 4b 03 04. FileInfo says PPT stayed the main save format until PowerPoint 2007 brought PPTX.
Can I convert a PPT file to PPTX or PDF?
Yes. LibreOffice converted 117 of our 127 regular PPT files to PPTX and to PDF, and the slide counts matched. We did not compare text or pictures, so page through the result. FileInfo says Google Slides can also convert a PPT file.
Why will my PPT file not open?
Eight causes cover what we saw in damaged PPT files. They are the wrong kind, changed signatures, wrong header fields, text mode copies, wrong pointers or tokens, renamed streams, cut files and bad data. Our script flagged or warned on 17 of 21 damaged copies.
How can I check if a PPT file is damaged?
Read the first 16 bytes of the PPT file, name the type with the file command and compare two readers. Our script also reads the token and the newest edit record. It passed 4 of 21 damaged copies, so only a second reader or the sender finds the rest.
Do all readers agree on a damaged PPT file?
No. Four readers disagreed on 15 of our 21 damaged copies, and on 10 copies none of them matched the original. Only one copy, with 512 zero bytes added, read the same in all four tools.
Can a damaged PPT file be repaired?
Some damage to a PPT file can be repaired. Thirteen kinds of header, pointer and name damage came back byte for byte in our tests. Cut files and zeroed data did not, because the bytes are gone. Keep the original and work on a copy.
What MIME type is a PPT file?
The file command prints application/vnd.ms-powerpoint for 124 of our 127 regular PPT files. IANA publishes a template page for that type. We did not read the registry row, so we state no status for it.
How big is a PPT file?
Our 127 regular PPT files are 9,684 to 3,333,632 bytes long, and the median is 110,592 bytes. 68 of them contain a Pictures stream. The size depends on what the presentation stores.
Still Stuck With a PPT File? Eight routes out, depending on what went wrong
Read the first bytes and use the check script. The cause table lists what to try in order.
The kind questions name the kind from the first bytes, the streams and the program.
Is it a newer presentation? Microsoft Support lists the endings that go with PPTX, like .pptm for macros and .ppsx for a slide show.
Is it a Word or Excel file? The guide to DOC files covers the older Word format, and the guide to XLS files covers the older Excel format.
Is it an Outlook message? An MSG file also starts with the compound file signature, and the guide to MSG files covers it.
Is it a document or an archive? The guide to PDF files covers documents for printing, and the guide to ZIP files covers the package behind a PPTX.
Is it a file type you do not know? Browse the file extension resource library, or send it on the submit a file type page.
Do you need the format facts? Read the format part for the container, the streams and the sources of PPT files.