What this OLE/CFB inspector checks
The parser recognizes CFB major versions 3 and 4, validates the header and sector geometry, follows header and external DIFAT entries into the FAT, follows the directory and MiniFAT chains, and reconstructs the reachable red-black directory tree. Every stream is assigned to regular FAT or MiniFAT storage according to the declared cutoff and compared with the chain length required by its declared byte size.
Allocation problems it can reveal
The report detects invalid sector IDs, cycles, short or overlong chains, duplicate FAT declarations, incorrect control-sector markers, shared regular or mini-sectors, unreachable allocated directory entries, and allocated physical sectors that no parsed control structure or reachable stream claims. These checks help distinguish a readable container from one whose internal allocation deserves forensic review.
Why familiar files use compound storage
Compound File Binary stores a hierarchy of storage objects and byte streams inside one file, much like a small filesystem. Older Word, Excel, and PowerPoint formats use it, as do Outlook MSG, Windows Installer databases, and other Microsoft or third-party formats. Recognized stream names are clues only: this tool inventories the container and does not decode the application document stored inside it.
Validation boundary
A clean result does not prove that the embedded document is safe, authentic, complete, or semantically valid. This bounded structural audit does not execute or analyze macros, decrypt protected content, parse Office records, MAPI properties, MSI tables, or embedded objects, scan for malware, recover deleted data, extract streams, repair allocation, or replace application-specific and forensic tools. Hex previews are limited to the first 32 declared stream bytes.
Frequently asked questions
Is the file uploaded?
No. The browser reads the selected file locally. The page has no upload endpoint and the report is generated in the tab.
Does it support modern DOCX, XLSX, and PPTX files?
Those formats are normally ZIP-based Office Open XML packages, not CFB containers. This tool targets classic binary Office files and other OLE structured-storage formats. Some encrypted OOXML documents may use a CFB wrapper, which the stream inventory can identify without decrypting it.
What is the difference between FAT and MiniFAT?
The FAT links ordinary sectors. Streams smaller than the 4,096-byte cutoff normally use 64-byte mini-sectors linked by the MiniFAT and stored inside the root mini-stream.
Can I extract an embedded stream?
No. Names, declared sizes, allocation chains, and a bounded first-byte preview are shown for diagnosis, but payload extraction is intentionally outside this page's scope.
Authoritative references
The structure and field rules follow Microsoft's Compound File Binary File Format specification. For an independent application integration reference, see Microsoft's open-source Compound File Reader.
Inspect an EBCDIC file · Inspect a COBOL copybook layout · Browse legacy-data tools