Magic numbers for keyring files?

Doug Barton dougb at
Wed Sep 25 17:31:43 CEST 2013

On 09/25/2013 06:18 AM, Robert J. Hansen wrote:
> I'm working on adding support for GnuPG keyrings to a file carver (a
> forensic tool that recovers data from damaged filesystems, or recovers
> things that have been deleted but not overwritten).  Detecting an
> ASCII-armored keyblock is pretty easy: look for the "BEGIN PGP PUBLIC"
> header.  Binary, though, is still an unsolved question.
> Before I start diving into code to find out if the keyring has a
> specific binary header I can detect, I figured I'd ask on-list.  :)
> Does anyone know of any magic numbers for GnuPG keyring files?

It would seem that they do exist:

file secring.gpg
secring.gpg: PGP key security ring

The folks that maintain the file(1) program used by most free Unices are 
really good about maintaining that information, and sharing it. I don't 
have all the details to hand atm, but it shouldn't take too much 
searching to find it. If you can't find any other handy repos to dig 
through should get you 
on your way.



More information about the Gnupg-users mailing list