Magic numbers for keyring files?

[Doug Barton]

On 09/25/2013 06:18 AM, Robert J. Hansen wrote:
> I'm working on adding support for GnuPG keyrings to a file carver (a
> forensic tool that recovers data from damaged filesystems, or recovers
> things that have been deleted but not overwritten).  Detecting an
> ASCII-armored keyblock is pretty easy: look for the "BEGIN PGP PUBLIC"
> header.  Binary, though, is still an unsolved question.
>
> Before I start diving into code to find out if the keyring has a
> specific binary header I can detect, I figured I'd ask on-list.  :)
>
> Does anyone know of any magic numbers for GnuPG keyring files?

It would seem that they do exist:


file secring.gpg
secring.gpg: PGP key security ring

The folks that maintain the file(1) program used by most free Unices are 
really good about maintaining that information, and sharing it. I don't 
have all the details to hand atm, but it shouldn't take too much 
searching to find it. If you can't find any other handy repos to dig 
through http://svnweb.freebsd.org/base/head/contrib/file/ should get you 
on your way.

hth,

Doug