How do you recognize a fake wallet.dat file?

What should you look for in the HEX editor, or are there other tools?