CDR Signature format

CorelDRAW CDR Signature Format: Specification & CDR Recovery Example

In its first versions, the CDR file format was a completely proprietary Corel file format primarily used for vector graphic drawings and developed by Corel Corp., recognizable by the first two bytes of the file being "WL". Starting with CorelDRAW 3, the file format changed to a Resource Interchange File Format (RIFF) envelope, recognizable by the first four bytes of the file being "RIFF", and a "CDR*vrsn" in bytes 9 to 15, with the asterisk "*" being in early versions just a blank, and beginning with Corel Draw 4, the version number of the writing program in hexadecimal ("4" meaning version 4, "D" meaning version 14).

The actual data chunk of the RIFF remains a Corel proprietary format. From version X4 (14) on, the CDR file is a ZIP-compressed directory of several files, among them XML-files and the RIFF-structured files.

Any RIFF container, including CDR drawing must have a signature (tag) RIFF (hex: 52 49 46 46) at the beginning of the file.

RIFF files are organized into data segments (chunks). Each segment is prefixed with an 12 byte header: 4 byte signature (RIFF), 4 byte data size (little-endian order, low byte first) and 4 byte RIFF Type: signature CDR*.

Asterisk "*" being in early versions just a blank, and beginning with Corel Draw 4, the version number of the writing program in hexadecimal ("4" meaning version 4, "D" meaning version 14). Chunk size is data size plus 8 bytes. Summarizing size for all found chunks, we calculate total file size.

Let's examine the sample

When inspecting sample.cdr file's data using any Hex Viewer, like Active@ Disk Editor, which is included in Active@ File Recovery package, we can see it starts with a signature RIFF (hex: 52, 49, 46, 46). At offset 8 there is a signature of CorelDRAW Drawing RIFF Type CDR9 (hex: 43, 44, 52, 39), which means CDR file's version is 9.

At offset 4 there is a data size: 20,088 (hex: 78, 4E, 00, 00) in little-endian order (low byte first). Adding header length to the data size, we calculate a total CDR file size: 20,088 + 8 = 20,096.

RIFF Files Header:

struct RIFF_Header
{
    uint32   SignatureRIFF;     // Signature: "RIFF"
    uint32   SizeRIFF;      // 4 byte file size, little-endian order
    uint32   SignatureTYPE;     // RIFF Subtype: "AVI ", "CDXA", "WAVE", "CDR*", ...
};

CorelDRAW CDR File Format

Active@ File Recovery Custom Scripting Example

This example just determins cdr start signature and calculates file size based on the size specified in RIFF header. Some additional validation included. Syntax of the signature definition language you can read here.

[CDR_HEADER]
DESCRIPTION=CorelDRAW Drawing File
EXTENSION=cdr
BEGIN=CDR_BEGIN
SCRIPT=CDR_SCRIPT

[CDR_BEGIN]
RIFF=0|0
CDR=8|8

[CDR_SCRIPT]
        size = read(dword, 4)
        size = sum(size, 8)
next:
        temp = read(dword, size)
        if (temp != "JUNK") goto label
        size = sum(size, 4)
        temp = read(dword, size)
        size = sum(size, 4)
        size = sum(size, temp)
        goto next
label:
        temp = and(temp, 00FFFFFFh)
        if (temp != "TAG") goto exit
        size = sum(size, 128)
        goto next