Forensics tools

File tree from archive

List the paths, sizes and structure inside a ZIP or TAR archive, without extracting anything.

Runs on your device. The file is never uploaded.

File tree from archive lists the paths, sizes and entry types inside a .zip or a POSIX ustar .tar. Nothing is inflated: the zip walk records each entry and returns false, and the tar walk steps over the data between 512-byte headers. 7z, RAR and gzipped tar are refused, and the tool reads one archive per run.

Input

Questions

Does it extract the files?

No, and that is the point. For a ZIP it walks the entries through fflate with a filter that records each one and returns false, so nothing is decompressed and no content is produced. For a TAR it reads the 512-byte headers and skips over the data. You get the listing without ever running the archive's contents through a decompressor.

What is in the listing?

For a ZIP: one line per entry with the stored path and its uncompressed size, plus the compressed size in brackets when it differs. For a TAR: the path, the size, and the entry type, where the type flag maps to file, directory, symlink or hardlink, and anything else prints as other with the raw flag character. The header line gives the archive kind and the entry count.

Why was my archive refused?

Because it is not a ZIP or a POSIX ustar TAR, which is what the message says, adding that 7z, RAR and gzipped or otherwise compressed tar need a different engine than this tool has. ZIP is detected by PK 03 04 or PK 05 06 at offset 0 and TAR by ustar at offset 257. For a .tar.gz, run Gzip decompress first, then list the .tar it produces.

Why does it say my zip is not valid?

Because fflate failed to walk the central directory, and the underlying reason is included in brackets in the message. That happens with truncated downloads, with an archive whose central directory is corrupt, and with encrypted or unusual ZIP variants. Check the start of the file with Hex viewer and look for a PK 05 06 record near the end.

Can I list several archives at once?

No, one at a time. Dropping more is refused with "file-tree-archive takes exactly 1 file", which comes from the tool being declared as single-file rather than per-file. Run it again for the next archive. Nothing is kept between runs, so each listing stands on its own and the order you process them in does not matter.

Is it safe to run on a suspicious archive?

Safer than extracting it, because nothing inside is decompressed, written to disk or executed, and nothing is uploaded. The listing itself is untrusted input though: paths in a malicious archive can contain directory traversal sequences and misleading extensions, so read them as data rather than acting on them.

Related Forensics tools