Crush — Format Reference

7-Zip Archive

Forensic relevance

General-purpose archive format with high compression ratios (LZMA/LZMA2), increasingly seen as a container for forensic tool output and exfiltrated data due to strong optional AES-256 encryption of both file contents and, with header encryption enabled, the file listing itself — an encrypted-header 7z gives no visibility into archive contents (names, sizes, timestamps) without the password. A 32-byte signature header at offset 0 points to the archive header at the end of the file, which holds the file list; timestamps are stored as UTC FILETIME with 100 ns precision (modification time always, creation and access time optionally). Solid compression (default) groups multiple files into shared compression blocks, meaning a single corrupted block can affect the recoverability of several unrelated files at once — a drawback compared with ZIP's per-file compression. Seen in the wild bundling malware droppers (compression ratio + optional encryption both help evade signature-based and content-inspection scanning), as well as legitimate acquisition tool exports.

Signatures

Known extensions

.7z

References

• 7z format overview and features (7-Zip) https://www.7-zip.org/7z.html
• .7z format specification (py7zr documentation) https://py7zr.readthedocs.io/en/latest/archive_format.html
• 7z format overview (Wikipedia) https://en.wikipedia.org/wiki/7z

Cite this entry

Crush Format Reference, “7-Zip Archive”. https://kalink0.github.io/crush-forensics/formats/7z/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction