Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to search for executable files in windows when it has been renamed? Say a .exe file has been renamed to a .txt or a .jpeg extension.

share|improve this question
    
@crudedude - you've got two accounts. This one (superuser.com/users/15411/crudedude) and the one used to post the answer (superuser.com/users/15719/crudedude). E-mail team@stackoverflow.com about getting them merged. –  ChrisF Oct 27 '09 at 23:14

4 Answers 4

You can use the Unix file utility, which can tell you what a file is based on its contents. You will need either the Cygwin environment or a win32-port package like GnuWin32 or UnxUtils.

Here's how file works:

# previously, e.exe was renamed to e.jpg
$ file e.jpg
e.jpg: MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit

Obviously, you have to give file a filename (or list of filenames) as an argument(s). You could do this with find if you know roughly where the file should be, by using find and a folder name:

$ find <foldername> -type f -print0 | xargs -0 file

If you combine this with grep, you can strip out the non-executables:

$ find e-0.02718 -type f -print0 | xargs -0 file | grep executable
e-0.02718/e.jpg:          MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit
e-0.02718/e.linux:        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.0.0, dynamically linked (uses shared libs), stripped
e-0.02718/e.sun4u56:      ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked (uses shared libs), stripped
e-0.02718/EXAMPLES:       Bourne shell script text executable
e-0.02718/makefile:       script text executable for make -f

Cygwin and GnuWin32 both provide the file and find commands (via the file and findutils packages).

UnxUtils includes find, but I can't verify that the file command is included. The package does not appear to be maintained, so GnuWin32 is probably a better option.

share|improve this answer
    
+1 for doing the seemingly impossible –  Phoshi Oct 27 '09 at 23:00

If i understand you OK, no.

still you could search for the filename...

BTW: why would you possibly change the extension of a EXE to txt, jpeg or so? There is no advantage of it and will lead in a txt matter to a bunch of unusable chars and jpeg to a 'cannot open'.

(i would change your tags, use something like 'exe' or 'search'

share|improve this answer
    
Binary files are not necessary extended with .exe...It could be that Firewalls, Filters etc. don't let .exe files pass, but if you rename it to .jpg, the Filter will be happy. –  Bobby Oct 25 '09 at 21:21
    
you could say it like that, but he's obviously talking about 'a .exe file...'. Yes, the filter will be happy with jpg, but ive done this stuff before and sometimes if you rename it back, it will not work. –  Deniz Zoeteman Oct 26 '09 at 17:13
1  
Renaming a file does nothing to the contents, a simple rename wouldn't cause failure. –  Phoshi Oct 27 '09 at 23:20
    
@phoshi: +1 correct. a file that "will not work" after renaming, transferring, and renaming back ...has probably gotten mangled in transfer. –  quack quixote Oct 27 '09 at 23:37

I would just make a search using a specific enough portion within the targetted file (which is apparently known in that case) ; it might be very slow, depending on the amount of data to process, but theoretically no more than any solution which would specifically recognize EXE files according to their content. It may not work with Windows Explorer though, because searching inside files is possible only for a limited range of extensions (for example, I tried to locate a specific portion of dialogue in SRT subtitle files but couldn't find a match, yet there was indeed a file containing the relevant portion).

share|improve this answer

You can use TrID to check the actual type of files and optionally change their extensions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.