Simply put, it is the unique identification information of a certain type of file. These logos sometimes display ASCII characters, such as RAR compressed files. At the beginning of the file, you can see Rar! These four words. Through these four characters, Winhex can judge that the file belongs to RAR compressed file. However, in most file header information, the file signature cannot display ASCII characters, so it is necessary to use hexadecimal values to represent the file signature. For example, in an MS OFFICE file, the file signature is d0cf11e0a1b11. Winhex/X-ways Forensics can also identify files as MS OFFICE files through these hexadecimal values.

offset

The offset in computer assembly language is defined as: the distance between the actual address of the storage unit and the segment address of the segment where it is located is called intra-segment offset, which is also called "effective address or offset". In real mode, the structure of memory is more chaotic than that in protected mode. The memory is divided into segments. When operating the memory, you need to specify the segment and offset. This segment register mode is a scar left by the limitations of early hardware circuits. At that time, the address bus had 20 bits. But the 20-bit address cannot be placed in the 16-bit register, which means that the 4 bits must be placed somewhere else. Therefore, in order to access all the memories, two 16 bit registers must be used. This design compromise leads to today's segment offset mode. In the initial design, one of the registers only has 4 bits. However, in order to simplify the procedure, both registers are valid with 16 bits, and a weighted sum is found to identify the 20-bit address during execution. The offset is 16 bits, so a segment is 64KB. The following figure can help to understand how the 20-bit address is formed: the address identified by segment-offset is usually recorded as segment: offset. For example, in WEDM process, the offset of molybdenum wire, that is, the diameter of molybdenum wire, is calculated.