'file' doesn't really read in any specific direction, it just uses a set of rules defined in /etc/magic or /usr/share/file/magic.* (there are compiled binary fo

'file' doesn't really read in any specific direction, it just uses a set of rules defined in /etc/magic or /usr/share/file/magic.* (there are compiled binary forms too, now) The rules can specify any offset for a magic file identifier, or set of identifiers. What determines what file will report, in cases like this, is really more a case of which order the rules are checked in.