Forensics · 36 tools · nothing uploads

ZIP structure

Read a ZIP central directory without extracting: entry list, compression method, ratios, offsets, and a zip-bomb heuristic.

Input

ZIP structure reads a ZIP's central directory without unpacking a file, listing each entry's compression method, sizes, ratio and header offset. An archive claiming more entries or bytes than classic fields allow gets read through the ZIP64 locator instead. A ratio past 100 to 1, or 1 GB declared, raises a zip-bomb warning; a missing directory record is refused.

Questions

Does this extract the files?

No, it only reads the central directory, entry names, sizes and offsets, without inflating any file content.

What does each row show?

Entry name, compression method, compressed and uncompressed size, compression ratio, and the local header offset.

Does it support ZIP64 archives?

Yes, it follows the ZIP64 locator and extra fields when an archive declares more entries or bytes than the classic 32-bit fields can hold.

What triggers the zip-bomb warning?

A compression ratio over 100 to 1 on any entry, or 1 GB of total declared uncompressed content across the archive.

What if there is no End Of Central Directory record?

The tool refuses, treating the file as not a ZIP or as truncated.

Compare

ToolRuns on the CLILive as you type
ZIP structureYesNo
Parse ASN.1YesNo
Parse Object IdentifierYesNo
TLV / Tag-Length-Value parserYesNo
ELF infoYesNo
PNG chunksYesNo
JPEG structureYesNo

Related Forensics tools