.EMF file signature
A Windows Enhanced Metafile image data file begins with the bytes 20 45 4D 46 ( EMF in ASCII) at offset 40 (0x28). The signature is the same whatever the file is named, which is why a renamed or extensionless EMF file is still recognisable.
Signature
| Offset | Hex | ASCII |
|---|---|---|
| 40 | 20 45 4D 46Record type 01 00 00 00 at offset 0, then the EMF signature at 40. | EMF |
MIME type: image/emf · usual extensions: .emf
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file.emf
file file.emfWindows (PowerShell):
Format-Hex -Path file.emf -Count 32This signature sits at offset 40, so look there rather than at the first bytes: xxd -s 40 -l 16 file.emf.
If the bytes do not match
A file named .emf whose first bytes are something else is not a EMF file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the EMF guide explains what a genuine file should contain.