## BMP Signature Format: Documentation & Recovery Example

BMP (bitmap image) files start with a signature BM and the next 4 bytes contain file's length.

Let's examine this particular BMP image When inspecting example.bmp file's binary data using any Hex Viewer, like Active@ Disk Editor we can see that it starts with a signature BM and next 4 bytes (hex: F6 04 00 00).

## Hexadecimal to decimal conversion

When we convert F6 04 00 00 to decimal format using little endian format (lowest significant byte first) we get:

` 00 00 04 F6→ 4F6`

In hexadecimal system F has value of 15

 Hexadecimal 0 1 2 3 4 5 6 7 8 9 A B C D E F Decimal 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

When calculating hexadecimal values the position of numbers is also very important.

The first number in our case is 4 therefore its position caries the value of 2, F has the value of 1 and 6 the value of 0 (zero).

Numbers will be multiplied with 16 power of the position's value. Meaning:

```
4F6 = 4 x 162 + 15 x 161 + 6 x 160
4F6 = 4 x 256 + 15 x 16 + 6 x 1
4F6 = 1024 + 240 + 6
4F6 = 1270
```

Therefore reading all of 1,270 consecutive bytes starting from the position of the detected BM header will provide us with all BMP file data.

For more about Little and Big Endian formats read here