OLE Compound File (CFB)
| Format | OLE Compound File (CFB) |
|---|---|
| Short name | CFB |
| Category | document |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Microsoft's Compound File Binary format: a FAT-like filesystem inside one file with storages and streams. It is the container of legacy Office documents (.doc, .xls, .ppt), Outlook .msg messages, Thumbs.db, Jump Lists, MSI installers and many application files. The SummaryInformation streams carry author, last saved by, creation and edit times; unallocated sectors can keep data of earlier versions.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | D0 CF 11 E0 A1 B1 1A E1 | ........ | Compound file signature D0 CF 11 E0 A1 B1 1A E1 |
| offset 0 (0x0) | 0E 11 FC 0D D0 CF 11 0E | ........ | Signature of early beta OLE2 compound files |
Known extensions
.doc, .xls, .ppt, .msg, .msi
References
- [MS-CFB]: Compound File Binary File Format, v12.0 (Microsoft) https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/53989ce4-7b05-4f8d-829b-d08d6148375b
- OLE Compound File format (libyal/libolecf) https://github.com/libyal/libolecf/blob/main/documentation/OLE%20Compound%20File%20format.asciidoc
Cite this entry
Crush Format Reference, “OLE Compound File (CFB)”. https://kalink0.github.io/crush-forensics/formats/cfb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction