{"success":true,"data":{"ext":"ecf","name":"MS Exchange 2007 extended configuration file","description":"The ECF file format is an extended configuration file used by Microsoft Exchange Server 2007, created and maintained by Microsoft. It is used to store administrative settings and deployment-related configuration data for Exchange 2007 environments and associated tools. As a legacy format tied to an older Exchange release, it is primarily of historical interest and should be handled cautiously when opening files from untrusted sources.","mime":[],"risk_level":"Safe","signatures":[{"hex":"5B 47 65 6E 65 72 61 6C 5D 0D 0A 44 69 73 70 6C 61 79 20 4E 61 6D 65 3D 3C 44 69 73 70 6C 61 79 4E 61 6D 65","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":[],"usage":{"python":"def is_ecf(file_path: str) -> bool:\n    \"\"\"Check if file is a valid ECF by magic bytes.\"\"\"\n    signature = bytes([0x5B, 0x47, 0x65, 0x6E, 0x65, 0x72, 0x61, 0x6C, 0x5D, 0x0D, 0x0A, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x20, 0x4E, 0x61, 0x6D, 0x65, 0x3D, 0x3C, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x4E, 0x61, 0x6D, 0x65])\n    with open(file_path, \"rb\") as f:\n        return f.read(36) == signature","node":"function isECF(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x5B, 0x47, 0x65, 0x6E, 0x65, 0x72, 0x61, 0x6C, 0x5D, 0x0D, 0x0A, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x20, 0x4E, 0x61, 0x6D, 0x65, 0x3D, 0x3C, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x4E, 0x61, 0x6D, 0x65]);\n  return buffer.subarray(0, 36).equals(signature);\n}","go":"func IsECF(data []byte) bool {\n    signature := []byte{0x5B, 0x47, 0x65, 0x6E, 0x65, 0x72, 0x61, 0x6C, 0x5D, 0x0D, 0x0A, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x20, 0x4E, 0x61, 0x6D, 0x65, 0x3D, 0x3C, 0x44, 0x69, 0x73, 0x70, 0x6C, 0x61, 0x79, 0x4E, 0x61, 0x6D, 0x65}\n    if len(data) < 36 {\n        return false\n    }\n    return bytes.Equal(data[:36], signature)\n}"}}}