Kindle books - .mobi, .azw3 and .prc - are Palm Database files whose EXTH metadata block records how the copy was obtained. A store download carries a per-purchase watermark and account-linked keys, the price and currency it was bought for, and a code that says whether it is a purchased book or a personal document sent to someone's Kindle. Mainstream tools skip most of this, or show it as a raw integer.
Scan a Kindle (MOBI, AZW3, PRC) fileThe buyer-identifying fields are what set a store copy apart. A per-purchase watermark is written when the book is bought and is unique to that purchase, so it can trace a shared copy back to the account that acquired it. Account-linked tamper-proof keys verify the file has not been altered and tie it to the account it was delivered to. Alongside them sit the DRM issuing records - a server ID, a commerce ID and an eBookBase book ID - written when the copy is licensed, present in EXTH whether or not the text itself is encrypted.
A scan reads the retail price and the currency the copy was charged in. The currency pins which regional store the file was bought from, which follows from the buyer's country and billing, and together with the ASIN it ties the file to a specific transaction. A borrowed or rented copy is flagged with its expiry, because lending is granted to a named account - a library card or a Kindle account - and a store sample is flagged as the free preview it is. An adult-content flag, if set, travels with the file and describes what someone was reading.
The content-type code is one File X-Ray decodes that the reference tool prints as a bare number. EBOK marks a purchased book; PDOC marks a personal document someone sent to a Kindle account, associated with the account that received it; other codes mark samples, magazines and newspapers. When the ASIN field holds a UUID instead of a catalogue ID it is a library identifier that is identical in every copy exported from that library, so two files carrying it came from the same person's collection.
The toolchain leaves its own fingerprint. The creator-software fields name the exact program, version and build that produced the file - kindlegen on Windows, Linux or Mac, or a converter like calibre - which narrows down the software and platform on the machine that made it. The format version distinguishes newer KF8/AZW3 from older Mobipocket, and a dual-format file holds both. Publisher restrictions are surfaced too: the share of the book a reader may copy, and whether text-to-speech is permitted. The standard author, publisher, ISBN, subjects and the header locale round it out - the last being a field the reference tool ignores entirely.
This is a selection. The full field manual documents the fields read from each format.
Beyond the author, publisher, ISBN and subjects, a Kindle file's EXTH block records how the copy was obtained: a purchase watermark and account-linked keys, the ASIN, the retail price and currency, DRM issuing IDs, a content-type code (purchased book, sample or personal document), any rental expiry, and the exact tool and build that produced it. File X-Ray also decodes the header locale and content type that reference tools skip or show as raw numbers.
A store copy carries a per-purchase watermark and account-linked tamper-proof keys that are unique to the transaction, plus the ASIN and the price and currency it was bought for. Together these can tie the file to the account that acquired it, which is exactly why they matter when a copy is passed around. A file that never came from a store will not have them.
The content-type code (EXTH 501) distinguishes them. EBOK marks a book purchased from the store. PDOC marks a personal document - something a person emailed or sent to their own Kindle - which is associated with the account that received it rather than bought from a catalogue. Most tools print this field as the raw integer 1161973579; File X-Ray decodes it to EBOK.
It can. A store copy often carries a retail-price field and a currency code. The currency identifies which regional store the file came from, which follows from the buyer's country and billing details, and together with the ASIN it links the file to a specific retail transaction.
The purchase watermark and account-linked keys are part of the DRM and the purchase record; they cannot simply be edited out, and File X-Ray only reads them rather than removing them. For a DRM-free personal document, re-converting it in a tool like calibre rewrites the EXTH block. The point of scanning is to see what a copy actually carries before you share it.
File X-Ray reads Kindle (MOBI, AZW3, PRC) files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.