Which file format starts with "45 52 02" bytes?

The file command tells me its an "Apple Driver Map, blocksize 512":

printf '\x45\x52\x02\x00\x00\x70' | file -
# /dev/stdin: Apple Driver Map, blocksize 512

The definition is in file's sourcecode in the file magic/Magdir/apple.

Interestingly, there is a disabled entry that would match even better: "Apple Partition data".

Well, I am not 100% on this, but it appears to be close to a Roxio Toast disk image file according to the list of file signatures found here on Wikipedia:

Roxio Toast disc image file, also some .dmg-files begin with same bytes.

The hex signature provided there is:

45 52 02 00 00 00

And the hex signature you are sharing is:

45 52 02 00 00 70

Note that the last hex value is 00 instead of 70 so this is even odder. Wonder if the 70 means the image is compressed? Similar info seems to be found in this definitions file for pyfsig; a Python file signature library.

Also—if I recall correctly—the .cdr extension on your file would seem to indicate to me that this disk image file was made with Roxio Toast.

And FWIW, files with the .dmg extension—as mentioned on the Wikipedia page—are macOS “Apple Disk Image” format images.


File Format