AFAIK often the file type signature is in the beginning of the data, however a proprietary elevator music solution could add their custom headers to the beginning of the stream, or, he might have captured data midstream