BMP Signature Format: Documentation & Recovery Example

BMP (bitmap image) files start with a signature BM and the next 4 bytes contain file's length.

Let's examine this particular BMP image

When inspecting example.bmp file's binary data using any Hex Viewer, like Active@ Disk Editor

we can see that it starts with a signature BM and next 4 bytes (hex: F6 04 00 00).

Hexadecimal to decimal conversion

When we convert F6 04 00 00 to decimal format using little endian format (lowest significant byte first) we get:

00 00 04 F6 → 4F6
In hexadecimal system F has value of 15

Hexadecimal 0  1  2  3  4  5  6  7  8  9   A   B   C   D   E   F
Decimal     0  1  2  3  4  5  6  7  8  9  10  11  12  13  14  15

When calculating hexadecimal values the position of numbers is also very important.

The first number in our case is 4 therefore its position caries the value of 2, F has the value of 1 and 6 the value of 0 (zero).

Numbers will be multiplied with 16 power of the position's value. Meaning:

4F6 = 4 x 162 + 15 x 161 + 6 x 160
4F6 = 4 x 256 + 15 x 16 + 6 x 1
4F6 = 1024 + 240 + 6
4F6 = 1270

Therefore reading all of 1,270 consecutive bytes starting from the position of the detected BM header will provide us with all BMP file data.